{"cvss":0.0,"datePublished":"2020-12-14T00:00:00Z","dateUpdated":"2020-12-14T00:00:00Z","description":"An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)","dueDate":"","id":"CVE-2019-11447","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"cutenews","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"cutephp cutenews Unrestricted Upload of File with Dangerous Type","vendor":"cutephp"}