CVE-2019-9608

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...

CVE-2019-9608

CVE-2019-9608 affects OFCMS prior to 1.1.3. The vulnerability arises in the backend ueditor/uploadImage path where blocking of .jsp/.jspx files does not account for file.jsp::$DATA, enabling remote attackers to execute arbitrary code. Public references in CNVD, NVD and Red Hat records corroborate...