PT-2020-19708 · Umbraco · Umbraco Forms

Adrian Gigliotti · Published 2020-07-28 · Updated 2023-03-02 · CVE-2020-7685

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions UmbracoForms versions (all versions)

Description The issue allows uploading arbitrary file types when using the default configuration for upload forms. Users can mitigate this by creating a custom workflow and frontend validation to block certain file types based on their security needs and policies.

Recommendations For all versions, create a custom workflow and implement frontend validation to block upload of unwanted file types, aligning with your security policies.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2020-7685

GHSA-8M73-W2R2-6XXJ

Affected Products

Umbraco Forms

References · 3

• https://osv.dev/vulnerability/GHSA-8m73-w2r2-6xxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7685 · Security Note
• https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765 · Note