CVE-2019-17199

2019-10-0520:15:10

Google

osv.dev

7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.3%

JSON

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg.. substring.

CPENameOperatorVersion
webpagetesteqWebPageTest-17.12
webpagetesteqWebPagetest-2.12
webpagetesteq18.09
webpagetesteqWebPageTest-2.17
webpagetesteq18.09.1
webpagetesteqWebPagetest-2.14
webpagetesteqWebPageTest-3.0
webpagetesteq18.08
webpagetesteqWebPagetest-2.15
webpagetesteqstable

Name	Operator	Version
webpagetest	eq	WebPageTest-17.12
webpagetest	eq	WebPagetest-2.12
webpagetest	eq	18.09
webpagetest	eq	WebPageTest-2.17
webpagetest	eq	18.09.1
webpagetest	eq	WebPagetest-2.14
webpagetest	eq	WebPageTest-3.0
webpagetest	eq	18.08
webpagetest	eq	WebPagetest-2.15
webpagetest	eq	stable

Rows per page:

1-10 of 171

References

github.com/WPO-Foundation/webpagetest/pull/1299