high7.2
CVE-2019-15123
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website.
Impact
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vikisolutions | Vera | Version 4.9.1.26180 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.vikisolutions.com/products/Vera.html
- https://www.gosecure.net/blog/2020/06/11/vera-vulnerable-to-authenticated-remote-code-execution-cve-2019-15123/
- http://www.vikisolutions.com/products/Vera.html
- https://www.gosecure.net/blog/2020/06/11/vera-vulnerable-to-authenticated-remote-code-execution-cve-2019-15123/