Lucene search

[email protected]NVD:CVE-2019-11028

HistoryApr 09, 2019 - 2:29 p.m.

CVE-2019-11028

2019-04-0914:29:00

CWE-434

[email protected]

web.nvd.nist.gov

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON

GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the “Documents” area. This vulnerability is related to “uploadDocFile.aspx”.

Affected configurations

Nvd

Node

gatshipweb_moduleRange<1.40

VendorProductVersionCPE
gatshipweb_module*cpe:2.3:a:gatship:web_module:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gatship	web_module	*	cpe:2.3:a:gatship:web_module::::::::

References

packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html

seclists.org/fulldisclosure/2019/Apr/33

seclists.org/fulldisclosure/2019/Apr/14

vuldb.com/?id.133141

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON

Related for NVD:CVE-2019-11028

cve1 prion1 cvelist1 zdt1