PT-2020-18749 · Hashbrown · Hashbrown Cms

Published 2020-01-06 · Updated 2022-05-24 · CVE-2020-5840

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.3.2

Description An issue in HashBrown CMS allows an attacker to reach a parent directory via a crafted name or ID field in the Server/Entity/Resource/Connection.js file.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Server/Entity/Resource/Connection.js file until a patch is applied. Avoid using crafted name or ID fields in the affected file to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-5840

GHSA-Q7HX-MRV5-6MRP

Affected Products

Hashbrown Cms

References · 7

• https://github.com/HashBrownCMS/hashbrown-cms/compare/v1.3.1...v1.3.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5840 · Security Note
• https://osv.dev/vulnerability/GHSA-q7hx-mrv5-6mrp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5840 · Vendor Advisory
• https://github.com/HashBrownCMS/hashbrown-cms/releases/tag/v1.3.2 · Note
• https://github.com/HashBrownCMS/hashbrown-cms/commit/6b37b73944447bb29c6aaeb086b04196d80c692a · Note
• https://github.com/HashBrownCMS/hashbrown-cms · Note