CVE-2018-9209: FineUploader php-traditional-server Unauthenticated Arbitrary File Upload Vulnerability
Summary
CVE-2018-9209: FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability. Affects fineuploader/php-traditional-server versions < 1.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FineUploader php-traditional-server is a package available on Packagist that provides functionality for handling file uploads in PHP applications. It allows developers to easily integrate file upload functionality into their projects. However, versions up to v1.2.2 of this package are vulnerable to an unauthenticated arbitrary file upload vulnerability.
Vulnerability Detail
The vulnerability in FineUploader php-traditional-server allows an attacker to upload arbitrary files to the server without authentication. This can lead to various security issues, such as remote code execution, unauthorized access to sensitive data, or the ability to upload malicious files that can be executed on the server. The vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
In conclusion, FineUploader php-traditional-server versions up to v1.2.2 are vulnerable to an unauthenticated arbitrary file upload vulnerability. It is crucial to update the package to a secure version and ensure proper validation and restriction of file uploads. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fineuploader/php-traditional-server →
FAQ
FineUploader php-traditional-server is a package that provides file upload functionality for PHP applications.
This vulnerability allows an attacker to upload arbitrary files to the server, potentially leading to remote code execution or unauthorized access to sensitive data.
To fix this vulnerability, update FineUploader php-traditional-server to a version higher than v1.2.2 and ensure proper validation and restriction of file uploads.
No, there is no known workaround. It is essential to update the package to a secure version.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
