PT-2020-16678 · Flexdotnetcms · Flexdotnetcms

Erik Wynter · Published 2020-11-12 · Updated 2021-07-21 · CVE-2020-27385

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FlexDotnetCMS versions prior to 1.5.11

Description The issue allows an authenticated remote attacker to bypass access controls and read and write to existing files outside the web root via directory traversal by entering a .. (dot dot) path in the input field of the "FileEditor" at the "/Admin/Views/FileEditor/" endpoint. In versions prior to 1.5.8, it is also possible to access files by specifying the full path.

Recommendations For versions prior to 1.5.11, update to version 1.5.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileEditor feature until a patch is available. Avoid using the FileEditor to access files outside the web root until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-27385

Affected Products

Flexdotnetcms

References · 4

• 🔥 https://blog.vonahi.io/whats-in-a-re-name · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27385 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27385 · Vendor Advisory
• https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.11 · Note