CVE-2019-17352 - CVE House
Back to Database
Status published High CVE-2019-17352

In JFinal cos before 2019-08-13, as used in JFinal 4.4,...

Vulnerability Description

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17352

Credits & Attribution

No credits recorded in the NVD database.

References

More from jfinal

View All →
CVE-2021-33348
An issue was discovered in JFinal framework v4.9.10 and below....
Medium 6.1
CVE-2021-31649
In applications using jfinal 4.9.08 and below, there is a...
Critical 9.8
CVE-2021-31635
Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a...
Critical 9.8

Affected Vendor

Affected Software

jfinal
Vulnerable Versions:
0

Timeline

Official Publish: October 8th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.