CVE-2019-11447 describes a critical remote code execution vulnerability in CutePHP CuteNews 2.1.2. An authenticated attacker can bypass file upload restrictions in the profile avatar upload feature by manipulating file headers, leading to arbitrary code execution on the server. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk with network-based exploitation, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed on the KEV catalog, public exploit code is available on ExploitDB, including a Metasploit module, and it has garnered significant community discussion and media coverage, suggesting potential for active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.1.2CPE matchmatch criteria | cpe:2.3:a:cutephp:cutenews:2.1.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.