CVE-2019-11028

GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx".
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
VendorProductVersion
gatshipweb_module
𝑥
< 1.40
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html
http://seclists.org/fulldisclosure/2019/Apr/33
https://seclists.org/fulldisclosure/2019/Apr/14
https://vuldb.com/?id.133141
http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html
http://seclists.org/fulldisclosure/2019/Apr/33
https://seclists.org/fulldisclosure/2019/Apr/14
https://vuldb.com/?id.133141