PT-2020-16276 · Cuppacms · Cuppacms

Yosri Debaibi · Published 2020-10-05 · Updated 2020-10-14 · CVE-2020-26048

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CuppaCMS versions prior to 2019-11-12

Description The issue allows an authenticated attacker to upload a malicious file with an image extension. Through a custom request using the rename function provided by the file manager, the attacker can modify the image extension into PHP, resulting in remote arbitrary code execution.

Recommendations For versions prior to 2019-11-12, update to a version released after 2019-11-12 to resolve the issue. As a temporary workaround, consider restricting access to the file manager's rename function to minimize the risk of exploitation. Avoid using the file manager to upload files with potentially executable extensions until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-26048

Affected Products

Cuppacms

References · 3

• https://osv.dev/vulnerability/CVE-2020-26048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26048 · Security Note
• https://github.com/CuppaCMS/CuppaCMS/issues/7 · Note