PT-2020-8913 · Kcfinder+1 · Kcfinder+1

Neil Drumm · Published 2020-12-31 · Updated 2021-01-11 · CVE-2018-25002

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KCFinder integration project for Drupal versions prior to 2018-06-01

Description The issue concerns the mishandling of validation in the uploader.php file. This could potentially lead to security issues, although specific details about exploitation or affected devices are not provided.

Recommendations For versions prior to 2018-06-01, consider disabling the uploader.php file as a temporary workaround until a patch is available. Restrict access to the vulnerable KCFinder integration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-25002

Affected Products

Drupal

Kcfinder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-25002 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25002 · Vendor Advisory
• https://drupal.org/project/kcfinder/issues/1768718 · Note
• https://drupal.org/project/kcfinder/issues/1768720 · Note
• https://t.me/cvenotify/8062 · Telegram Post
• https://drupal.org/sa-contrib-2018-024 · Note