CVE-2020-27386
Last modified
CVE-2020-27386 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.. EPSS estimates a 72.87% chance of exploitation in the next 30 days.
Description
An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flexdotnetcms Project | Flexdotnetcms | < 1.5.9 |
References
- http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.htmlThird Party Advisory, VDB Entry
- https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
- https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9Release Notes, Third Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/14339Exploit, Patch, Third Party Advisory
- http://packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upload.htmlThird Party Advisory, VDB Entry
- https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
- https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9Release Notes, Third Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/14339Exploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-27386?
How severe is CVE-2020-27386?
How do I fix CVE-2020-27386?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-27377A cross-site scripting (XSS) vulnerability was discovered in…4.8
- CVE-2020-27379Cross Site Request Forgery (CSRF) vulnerability in Booking C…6.5
- CVE-2020-2738Vulnerability in the Siebel UI Framework product of Oracle S…4.3
- CVE-2020-27383Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an el…7.8
- CVE-2020-27384The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffe…7.8
- CVE-2020-27385Incorrect Access Control in the FileEditor (/Admin/Views/Fil…8.1
- CVE-2020-27387An unrestricted file upload issue in HorizontCMS through 1.0…8.8
- CVE-2020-27388Multiple Stored Cross Site Scripting (XSS) vulnerabilities e…5.4
- CVE-2020-2739Vulnerability in the Oracle WebCenter Sites product of Oracl…7.4
- CVE-2020-27397Marital - Online Matrimonial Project In PHP version 1.0 suff…8.8
- CVE-2020-2740Vulnerability in the Oracle Access Manager product of Oracle…4.6
- CVE-2020-27402The HK1 Box S905X3 TV Box contains a vulnerability that allo…7.8
Are you affected by CVE-2020-27386?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST