PT-2021-10248 · Bludit · Bludit

Liao10086 · Published 2021-08-20 · Updated 2021-08-24 · CVE-2020-18879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bludit version 3.8.1

Description: The issue allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'. This is an instance of an unrestricted file upload, which can be exploited to gain unauthorized access and control.

Recommendations: For Bludit version 3.8.1, consider disabling the 'bl-kereln/ajax/upload-logo.php' component until a patch is available to prevent the upload of malicious files. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for file uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-18879

Affected Products

Bludit

References · 4

• 🔥 https://github.com/bludit/bludit/issues/1011 · Exploit
• https://osv.dev/vulnerability/CVE-2020-18879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18879 · Security Note
• https://t.me/cibsecurity/27639 · Telegram Post