CWE Code: 434
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Unrestricted Upload of File with Dangerous Type
Summary: openkm 6.3.2 through 6.3.7 allows an attacker to upload a malicious jsp file into the /okm:root directories and move that file to the home directory of the site, via frontend/fileupload and admin/repository_export.jsp. this is achieved by interfering with the filesystem path control in the admin's export field. as a result, attackers can gain remote code execution through the application server with root privileges.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-04-22
Last Modified Date: 2019-04-23