critical9.8
CVE-2019-19502
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
Impact
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Maleck | Image Uploader And Browser For Ckeditor | before 4.1.9 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
- https://visat.me/security/cve-2019-19502/
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
- https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
- https://visat.me/security/cve-2019-19502/