CVE-2019-9609

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/editUploadImage URI...

CVE-2019-9609

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/editUploadImage URI...

CVE-2019-9609

CVE-2019-9609 affects OFCMS prior to 1.1.3. The issue arises because blocking of .jsp/.jspx files does not account for file.jsp::$DATA when targeting the admin/comn/service/editUploadImage URI, enabling remote attackers to execute arbitrary code. Product: OFCMS; version: before 1.1.3; component: ...