CVE-2019-17352

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file

published October 8, 2019

CVSS
—
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01743 · 77.6th percentile
Published
2019-10-08T12:13Z
EPSS history
Timeline
  • 08 OCT 12:13Z
    In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file
    cvelistv5