{"id":"CVE-2019-16318","published":"2019-09-14T17:01:15Z","modified":"2024-08-05T01:10:41Z","title":"In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01399,"percentile":0.72469,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/pimcore/pimcore/commit/732f1647cc6e0a29b5b1f5d904b4d726b5e9455f","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-451598","tags":["x_refsource_MISC"]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":14.49}]},"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.7.1"],"patched":["5.7.1"],"from":["GHSA-cxj7-4jpj-2q38"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3662","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-14059","published":"2018-08-24","fixed":"5.3.0","kev":false,"link":{"from":"CVE-2018-14059","to":"CVE-2019-16318","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"5.3.0","toFixed":"5.7.1","daysApart":386}]}},{"cve":"CVE-2019-10867","published":"2019-04-04","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16317","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-16318","published":"2019-09-14","fixed":"5.7.1","kev":false},{"cve":"CVE-2019-18981","published":"2019-11-15","fixed":"6.2.2","kev":false},{"cve":"CVE-2019-18985","published":"2019-11-15","fixed":"6.2.2","kev":false},{"cve":"CVE-2019-18986","published":"2019-11-15","fixed":"6.2.2","kev":false}],"package":"Packagist:pimcore/pimcore"}}