Vulnerability Details CVE-2019-1010062
PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2019-1010062
-
cpe:2.3:a:pluck-cms:pluckcms:4.7
-
cpe:2.3:a:pluck-cms:pluckcms:4.7.2
-
cpe:2.3:a:pluck-cms:pluckcms:4.7.3
-
cpe:2.3:a:pluck-cms:pluckcms:4.7.4