Skip to content
Fencer Vulns
high 8.8

CVE-2018-19135 json

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default).

published 2018-11-11 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-10847

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
1
Exploit-DB

Summary

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

Timeline

  1. Published
  2. First public exploit (EDB-45839)

Exploit prediction

2.96% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-45839 ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload) webapps, 2018-11-13
  • github.com https://github.com/ClipperCMS/ClipperCMS/issues/494 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.