CVE-2019-6839

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
8.8HIGH
EPSS
0.5%
top 34.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Meg6260-0410 FirmwareSchneider-electric Meg6260-0415 FirmwareSchneider-electric Meg6501-0001 Firmware+1 more
Timeline
PublishedSep 17
Latest updateMay 24

Description

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow a user with low privileges to upload a rogue file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

🔴Vulnerability Details

2
GHSA
GHSA-f2vv-v8xv-qgm8: An Improper Access Control: CWE-284 vulnerability exists in U↗2022-05-24
▶
CVEList
CVE-2019-6839: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U↗2019-09-17
▶
CVE-2019-6839 (HIGH CVSS 8.8) | A CWE-434: Unrestricted Upload of F | cvebase.io