PT-2020-16491 · Sentrifugo · Sentrifugo

Published 2020-11-12 · Updated 2020-11-17 · CVE-2020-26803

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2

Description The issue affects the "Upload Images" functionality under the "Assets -> Add" tab, where users can upload malicious files due to an "Unrestricted File Upload" vulnerability. This allows an attacker to upload malicious files and potentially control the server.

Recommendations For Sentrifugo version 3.2, consider disabling the "Upload Images" functionality under the "Assets -> Add" tab until a patch is available to prevent exploitation of the "Unrestricted File Upload" vulnerability.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-26803

Affected Products

Sentrifugo

References · 5

• 🔥 https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated_6.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26803 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26803 · Vendor Advisory
• https://t.me/cvenotify/5689 · Telegram Post
• https://t.me/cibsecurity/16257 · Telegram Post