PT-2023-11544 · Ebcms · Ebcms

Macchiatto725 · Publicado 2023-06-20 · Atualizado 2024-12-11 · CVE-2020-20067

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ebCMS version 1.1.0

Description The issue allows a remote attacker to execute arbitrary code via the upload type parameter. This enables the attacker to potentially gain control over the system, leading to unauthorized access and malicious activities.

Recommendations For ebCMS version 1.1.0, consider restricting access to the file upload feature until a patch is available. As a temporary workaround, avoid using the upload type parameter in the affected API endpoint.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2020-20067

Produtos afetados

Ebcms

Referências · 4

• 🔥 https://github.com/a932278490/ebcms/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20067 · Aviso do Fabricante
• https://t.me/cibsecurity/65363 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-20067 · Nota de Segurança