CVE-2020-15182
The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE).
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.
- CVSS 3.1
- 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 1.17% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22, CWE-352
- Affected
- soy cms project/soy cms · soy inquiry project/soy inquiry
- Source
- security-advisories@github.com
References
- https://github.com/inunosinsi/soycms/pull/15Patch, Third Party Advisory
- https://github.com/inunosinsi/soycms/security/advisories/GHSA-j2qw-747j-mfv4Third Party Advisory
- https://youtu.be/ffvKH3gwyREExploit, Third Party Advisory
- https://github.com/inunosinsi/soycms/pull/15Patch, Third Party Advisory
- https://github.com/inunosinsi/soycms/security/advisories/GHSA-j2qw-747j-mfv4Third Party Advisory
- https://youtu.be/ffvKH3gwyREExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.