Description

In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.

Remediation

References

CVE-2019-9889

Related Vulnerabilities

Apache Tomcat Other Vulnerability (CVE-2002-0936)

WordPress Plugin Generate Child Theme Security Bypass (1.5.3)

Django Resource Management Errors Vulnerability (CVE-2014-0474)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8398)

WordPress Plugin Google XML Sitemap for Videos Cross-Site Request Forgery (2.6.1)

Severity

Low

Classification

CVE-2019-9889 CWE-22 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities