CVE-2020-27387

Published Nov 5, 2020

Last updated 2 years ago

CVSS high 8.8

Overview

Description: An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "819778BF-D6F0-41DE-ADF2-3BB80E05DD93"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BDF18A37-08AC-4501-8C15-151DE7B44DED"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E6F3AB6F-BD6E-4F8C-952F-AB55E11D7D23"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1817B54-40E9-4150-8A24-2023FD19BB43"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A6585D37-41CF-436A-A4AA-F91AE092D288"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E496572C-0A79-4524-B544-E864FBFEDFD8"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7117177-3CD2-4BE9-982A-FBFEF60A7C23"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB1E6057-C7F5-4D4F-B112-437C801DCCF4"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:beta:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "320BB8EF-D310-4420-9EA9-CA06DFA03DE5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References