PT-2020-18300 · Fat Free Framework · Fat-Free Framework

Ikkez · Published 2020-03-11 · Updated 2022-05-24 · CVE-2020-5203

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fat-Free Framework version 3.7.1

Description The issue allows attackers to achieve arbitrary code execution if developers pass user-controlled input, such as $ REQUEST, $ GET, or $ POST, to the framework's Clear method. This can lead to exploitation when user input is not properly sanitized.

Recommendations For Fat-Free Framework version 3.7.1, avoid passing user-controlled input to the Clear method until a patch is available. As a temporary workaround, consider validating and sanitizing all user input before passing it to the framework's methods to minimize the risk of exploitation.

Fix

Special Elements Injection

Code Injection

RCE

Weakness Enumeration

CWE-74

CWE-94

CWE-20

Related Identifiers

CVE-2020-5203

GHSA-HPJ2-4HFJ-G233

Affected Products

Fat-Free Framework

References · 7

• https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829 · Patch
• https://osv.dev/vulnerability/GHSA-hpj2-4hfj-g233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5203 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5203 · Vendor Advisory
• https://github.com/bcosca/fatfree/releases · Note
• https://github.com/bcosca/fatfree · Note
• https://t.me/cvenotify/1510 · Telegram Post