CVE-2019-14924

EUVD-2019-6022
An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Affected Products (NVD)
VendorProductVersion
gcdwebserver_projectgcdwebserver
𝑥
< 3.5.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802
https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3
https://github.com/swisspol/GCDWebServer/issues/433
https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802
https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3
https://github.com/swisspol/GCDWebServer/issues/433