CVE-2019-14924

2019-08-1019:15:10

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

52.2%

JSON

An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).

CPENameOperatorVersion
gcdwebservereq3.2.7
gcdwebservereq1.0
gcdwebservereq3.5.2
gcdwebservereq3.2.3
gcdwebservereq2.3.1
gcdwebservereq1.1
gcdwebservereq2.3.2
gcdwebservereq3.0.1
gcdwebservereq2.1
gcdwebservereq1.2.2

Name	Operator	Version
gcdwebserver	eq	3.2.7
gcdwebserver	eq	1.0
gcdwebserver	eq	3.5.2
gcdwebserver	eq	3.2.3
gcdwebserver	eq	2.3.1
gcdwebserver	eq	1.1
gcdwebserver	eq	2.3.2
gcdwebserver	eq	3.0.1
gcdwebserver	eq	2.1
gcdwebserver	eq	1.2.2