CVE-2020-25790

Опубликовано: 19 сент. 2020

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Средний

Описание

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2

Ссылки

http://packetstormsecurity.com/files/159503/Typesetter-CMS-5.1-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/159615/Typesetter-CMS-5.1-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Oct/11
Mailing List
Third Party Advisory
https://github.com/Typesetter/Typesetter/issues/674
Third Party Advisory
http://packetstormsecurity.com/files/159503/Typesetter-CMS-5.1-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/159615/Typesetter-CMS-5.1-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Oct/11
Mailing List
Third Party Advisory
https://github.com/Typesetter/Typesetter/issues/674
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:typesettercms:typesetter:*:*:*:*:*:*:*:*

Версия от 5.0 (включая) до 5.1 (включая)

EPSS

Процентиль: 97%

0.41166

Средний

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-c7mg-73jx-7c7x