CVE-2019-9613

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

CVE-2019-9613

CVE-2019-9613 affects OFCMS prior to 1.1.3. The issue arises in the backend ueditor/uploadVideo handling where blocking of .jsp and .jspx files fails to consider file.jsp::$DATA, enabling remote attackers to execute arbitrary code via the admin/ueditor/uploadVideo URI. Documents consistently desc...