{"id":"CVE-2019-16317","published":"2019-09-14T17:01:41Z","modified":"2024-08-05T01:10:41Z","title":"In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01698,"percentile":0.77187,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/pimcore/pimcore/commit/6ee5d8536d0802e377594cbe39083e822710aab9","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-451599","tags":["x_refsource_MISC"]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":15.44}]},"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.7.1"],"patched":["5.7.1"],"from":["GHSA-352x-hc2f-fwff"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2108","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-14058","published":"2018-08-17","fixed":"5.3.0","kev":false},{"cve":"CVE-2018-14059","published":"2018-08-24","fixed":"5.3.0","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-16317","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":386}]}},{"cve":"CVE-2019-10867","published":"2019-04-04","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16317","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16318","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-18981","published":"2019-11-15","fixed":"6.2.2","kev":false},{"cve":"CVE-2019-18985","published":"2019-11-15","fixed":"6.2.2","kev":false}],"package":"Packagist:pimcore/pimcore"}}