CVE-2019-11401 — Vulnerability in sscms — CVE Details

HIGH

SiteServer CMS RCE via unsafe file upload

Published May 24, 2022Updated February 16, 2024Source: osv

Summary

A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension `.aassp`, which is converted to `.asp` because the "as" substring is deleted.

Advisory Timeline

First published May 24, 2022 (1602 days ago).
Last revised February 16, 2024 — 633 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update sscms to 6.12 or later

dotnet add package sscms --version 6.12

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: nuget (1).

Package	Ecosystem	Affected	Fixed In
sscms	nuget	1.0.0-preview4	6.12

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-434
Unrestricted File UploadMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.2 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2019-11401?: SiteServer CMS RCE via unsafe file upload This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.2/10).
How do I check if my project is affected by CVE-2019-11401?: CVE-2019-11401 affects sscms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-11401 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.2

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-ff4w-8chr-w2x9

Related CVEs

CVE-2021-42655
HIGH
SQL injection in SiteServer CMS
CVE-2026-106112
HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
CVE-2026-106115
HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
CVE-2023-2862
MEDIUM
SSCMS vulnerable to Cross Site Scripting

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies