high8.8
CVE-2019-9617
An issue was discovered in OFCMS before 1.1.3.
Impact
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ofcms Project | Ofcms | before 1.1.3 |