CVE-2020-37117
Last modified
CVE-2020-37117 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.. EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jizhicms | Jizhicms | 1.6.7 |
References
- https://www.exploit-db.com/exploits/48361Exploit, VDB Entry
- https://www.jizhicms.cn/Product
- https://www.vulncheck.com/advisories/jizhicms-arbitrary-file-downloadThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2020-37117?
How severe is CVE-2020-37117?
How do I fix CVE-2020-37117?
Are you affected by CVE-2020-37117?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST