CVE-2019-11445 - CVE House
Back to Database
Status published High CVE-2019-11445

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a...

Vulnerability Description

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11445

Credits & Attribution

No credits recorded in the NVD database.

References

More from openkm

View All →
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript: substring...
Medium 5.4
CVE-2021-33950
An issue discovered in OpenKM v6.3.10 allows attackers to obtain...
Unknown 0
CVE-2014-9017
Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338)...
Low 3.5
CVE-2014-8957
Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote...
Medium 5.4
CVE-2012-2316
Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7...
Medium 6.8

Affected Vendor

Affected Software

openkm
Vulnerable Versions:
0

Timeline

Official Publish: April 22nd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.