PT-2020-6425 · Civicrm · Civicrm

Dennis Brinkrolf + 2 · CVE-2020-36388 · Published 2020-04-05 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CiviCRM versions 5.22.x through 5.24.x before 5.24.3 CiviCRM versions prior to 5.21.3

Description The issue in CiviCRM is related to the possibility of uploading and executing PHAR archives. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For CiviCRM versions prior to 5.21.3, update to version 5.21.3 or later. For CiviCRM versions 5.22.x through 5.24.x before 5.24.3, update to version 5.24.3 or later. As a temporary workaround, consider restricting the ability to upload and execute PHAR archives until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-04645

BIT-CIVICRM-2020-36388

CVE-2020-36388

Affected Products

Civicrm

References · 12

• 🔥 https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained · Exploit
• https://ubuntu.com/security/CVE-2020-36388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36388 · Security Note
• https://bdu.fstec.ru/vul/2021-04645 · Security Note
• https://civicrm.org/advisory/civi-sa-2020-03 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-civicrm-2020-36388 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36388 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36388 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36388 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36388 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36388 · Vendor Advisory
• https://t.me/cvenotify/38987 · Telegram Post