CVE-2019-18643: sparkdevnetwork rock rms

csirt@kutim:~/threat-intel/cve/CVE-2019-18643

CVSS 9.8 · Critical EPSS 4,3%

Kerentanan Unrestricted Upload of File with Dangerous Type pada sparkdevnetwork rock rms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to upload ASPX code and gain remote code execution on the application. The application typically runs as LocalSystem as mandated in the installation guide. Patched in versions 8.10 and 9.4.

Rincian

Terbit di NVD: 7 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 4,3% peluang dieksploitasi; lebih tinggi dari 90,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sparkdevnetwork	rock rms	Semua versi sebelum 8.10
sparkdevnetwork	rock rms	Versi 9.0 hingga sebelum 9.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.