{"id":"CVE-2019-11401","aliases":["GHSA-ff4w-8chr-w2x9"],"url":"https://o3.security/vulnerability/CVE-2019-11401","summary":"SiteServer CMS RCE via unsafe file upload","details":"A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension `.aassp`, which is converted to `.asp` because the \"as\" substring is deleted.","published":"2019-04-22T11:29:04.313Z","modified":"2026-08-07T14:49:58.216315Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"NuGet","name":"sscms","fixedVersion":"6.12"}],"fix":{"url":"https://github.com/siteserver/cms/commit/a7edb9ce3f9b52be3d18fa8a0e44931264e22436#diff-c8a06aaffb97eb2f4c587c1786906edd49dea574d063f74a59d9653ee0d5718b","label":"siteserver/cms@a7edb9c"},"references":[{"type":"EVIDENCE","url":"https://github.com/siteserver/cms/issues/1858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11401"},{"type":"WEB","url":"https://github.com/siteserver/cms/commit/a7edb9ce3f9b52be3d18fa8a0e44931264e22436#diff-c8a06aaffb97eb2f4c587c1786906edd49dea574d063f74a59d9653ee0d5718b"},{"type":"PACKAGE","url":"https://github.com/siteserver/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T14:49:58.216315Z"}}