CVE-2018-19420

2018-11-2121:29:00

Google

osv.dev

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

24.8%

JSON

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.

CPENameOperatorVersion
getsimplecmseq3.3.6
getsimplecmseq3.3.1
getsimplecmseq3.1.1
getsimplecmseq3.3.2
getsimplecmseq3.3.14
getsimplecmseq3.2.0
getsimplecmseq3.2.3
getsimplecmseq3.3.3
getsimplecmseq3.3.7
getsimplecmseq3.3.5

Name	Operator	Version
getsimplecms	eq	3.3.6
getsimplecms	eq	3.3.1
getsimplecms	eq	3.1.1
getsimplecms	eq	3.3.2
getsimplecms	eq	3.3.14
getsimplecms	eq	3.2.0
getsimplecms	eq	3.2.3
getsimplecms	eq	3.3.3
getsimplecms	eq	3.3.7
getsimplecms	eq	3.3.5