Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2018-10795 - Vulnerability Database
Liferay Portal

Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2018-10795

High
Reference: CVE-2018-10795
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-10795
Title: Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability
Overview:

DISPUTED Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product39s environment via a browser/liferay/browser.htmlType or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature subject to Role Based Access Control checks where only authenticated users with proper permissions can upload files.