CVE-2019-19634
CRITICAL9.8EPSS 15.0%class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Published: 2/28/2020Modified: 11/8/2023
Also known as:GHSA-2gc7-w4hw-rr2m
Description
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Affected packages (1)
- Packagist/verot/class.upload.phpfrom 0, <= 1.0.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |