CVE-2019-16317
on github
Published
Severity
CVSS v3:
8.8 HIGH
CVSS v2:
6.5 MEDIUM
Description
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
References
Configurations
| CPE23 | Version Start | Version End | Exact Version |
|---|---|---|---|
| cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* | n/a | 5.7.1 | * |