CVE-2019-9617

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...

CVE-2019-9617

CVE-2019-9617 affects OFCMS prior to 1.1.3. The issue is a remote code execution vector where blocking of *.jsp and *.jspx files does not consider file.jsp::$DATA in the admin/ueditor/uploadFile URI, enabling arbitrary code execution. The connected sources confirm the affected product/version and...