VulnerabilityModified
CVE-2020-20691
An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.
MEDIUM 6.5EPSS 0.93%
Does this matter?
Lower severity and a low EPSS score (0.93%). Track it; it rarely justifies an emergency change on its own.
Description
An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.93% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- monstra/monstra cms
- Source
- cve@mitre.org
References
- https://github.com/monstra-cms/monstra/issues/461Exploit, Issue Tracking, Third Party Advisory
- https://github.com/monstra-cms/monstra/issues/461Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.