CVE-2018-10795 — Unrestricted File Upload in Portal

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.3%
top 43.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Liferay Portal
Timeline
PublishedMay 7
Latest updateMay 14

Description

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature, subject to Role Based Access Control checks where only authenticated users with proper permissions ca…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-2xx5-jpqr-vq6g: ** DISPUTED ** Liferay 6↗2022-05-14
▶
CVEList
CVE-2018-10795: Liferay 6↗2018-05-07
▶
CVE-2018-10795 — Unrestricted File Upload in Portal | cvebase