PT-2021-12059 · Portable · Portable Ltd Playable

Published 2021-10-22 · Updated 2021-10-28 · CVE-2020-36485

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Portable Ltd Playable version 9.18

Description: The issue allows attackers to execute arbitrary code via a crafted JPEG file, exploiting an arbitrary file upload vulnerability in the filename parameter of the upload module.

Recommendations: For Portable Ltd Playable version 9.18, consider restricting access to the upload module to minimize the risk of exploitation. Avoid using the filename parameter in the affected upload module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-36485

Affected Products

Portable Ltd Playable

References · 4

• 🔥 https://vulnerability-lab.com/get_content.php?id=2198 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36485 · Security Note
• https://t.me/cibsecurity/31060 · Telegram Post