← Back

CVE-2019-19634

nvd nist
Published: Dec 17, 2019Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Affected (3)

Products: Verot Project: Verot · Getk2: K2
Verot Project
1 product
Verot
Getk2
1 product
K2
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Verot Project
Verot
Before 1.0.3
Verot
From 2.0.0 to 2.0.4
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
K2
Up to 2.10.1

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (6)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.