low2.7
CVE-2019-9889
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class.
Impact
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vanillaforums | Vanilla | before 2.6.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/vanilla/vanilla/compare/b043ae8...9f12b22
- https://github.com/vanilla/vanilla/pull/7840
- https://hackerone.com/reports/411140
- https://github.com/vanilla/vanilla/compare/b043ae8...9f12b22
- https://github.com/vanilla/vanilla/pull/7840
- https://hackerone.com/reports/411140