VULNERABILITY INTELLIGENCE

CVE-2019-14924

CVSS score7.5 HIGH
EPSS probability2.03%
CISA KEVNot currently listed
Published2019-08-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).

Weakness classification

  • nvd@nist.gov: CWE-863

Primary references