VulnerabilityModified

CVE-2020-27386

HIGH 8.8EPSS 72.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 72.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 72.87% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: flexdotnetcms project/flexdotnetcms
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.htmlThird Party Advisory, VDB Entry
https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9Release Notes, Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/14339Exploit, Patch, Third Party Advisory
http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.htmlThird Party Advisory, VDB Entry
https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9Release Notes, Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/14339Exploit, Patch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.