PT-2020-17848 · Bolt · Bolt Cms

Bobdenotter + 1 · Published 2020-06-08 · Updated 2022-10-07 · CVE-2020-4041

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bolt CMS versions prior to 3.7.1

Description The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.

Recommendations For versions prior to 3.7.1, update to Bolt 3.7.1 to resolve the issue. As a temporary workaround, consider restricting the ability to rename uploaded files until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-4041

GHSA-68Q3-7WJP-7Q3J

Affected Products

Bolt Cms

References · 10

• 🔥 http://seclists.org/fulldisclosure/2020/Jul/4 · Exploit
• 🔥 http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html · Exploit
• https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419f · Patch
• https://github.com/bolt/bolt/pull/7853 · Patch
• https://github.com/bolt/bolt/security/advisories/GHSA-68q3-7wjp-7q3j · Patch
• https://osv.dev/vulnerability/GHSA-68q3-7wjp-7q3j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4041 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4041 · Vendor Advisory
• https://github.com/bolt/bolt · Note
• https://t.me/cvenotify/4244 · Telegram Post