PT-2020-13296 · Pydio · Pydio Cells

Published 2020-06-04 · Updated 2021-07-21 · CVE-2020-12851

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pydio Cells version 2.0.4

Description The issue allows an authenticated user to write or overwrite existing files in another user's personal and cells folders by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders.

Recommendations For Pydio Cells version 2.0.4, consider disabling the file extraction feature as a temporary workaround until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12851

Affected Products

Pydio Cells

References · 6

• 🔥 https://coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12851 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12851 · Vendor Advisory
• https://coresecurity.com/advisories · Note
• https://t.me/cvenotify/4219 · Telegram Post
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html · Note