PT-2020-13293 · Pydio · Pydio Cells

Published 2020-06-05 · Updated 2021-07-21 · CVE-2020-12848

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pydio Cells version 2.0.4

Description In Pydio Cells, when an authenticated user shares a file and selects the option to create a public link, a hidden shared user account is created in the backend with a random username. If an anonymous user obtains a valid public link, they can retrieve the associated hidden account username and password, allowing them to log in to the web application. Once logged in with the hidden user account, they can perform actions that were not available through the public share link.

Recommendations For Pydio Cells version 2.0.4, consider disabling the public link sharing feature until a patch is available to prevent the creation of hidden shared user accounts. Restrict access to sensitive actions within the web application to minimize the risk of exploitation by anonymous users who may have obtained a valid public link.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-12848

Affected Products

Pydio Cells

References · 6

• 🔥 https://coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-12848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12848 · Security Note
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html · Note
• https://coresecurity.com/advisories · Note
• https://t.me/cvenotify/4225 · Telegram Post