CVE-2020-7685
Last modified
CVE-2020-7685 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. EPSS estimates a 0.90% chance of exploitation in the next 30 days.
Description
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Forms | All versions |
References
- https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765Third Party Advisory
- https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-7685?
How severe is CVE-2020-7685?
How do I fix CVE-2020-7685?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-7679In all versions of package casperjs, the mergeObjects utilit…9.8
- CVE-2020-7680docsify prior to 4.11.4 is susceptible to Cross-site Scripti…6.1
- CVE-2020-7681This affects all versions of package marscode. There is no p…7.5
- CVE-2020-7682This affects all versions of package marked-tree. There is n…7.5
- CVE-2020-7683This affects all versions of package rollup-plugin-server. T…7.5
- CVE-2020-7684This affects all versions of package rollup-plugin-serve. Th…9.8
- CVE-2020-7686This affects all versions of package rollup-plugin-dev-serve…7.5
- CVE-2020-7687This affects all versions of package fast-http. There is no …7.5
- CVE-2020-7688The issue occurs because tagName user input is formatted ins…7.8
- CVE-2020-7689Data is truncated wrong when its length is greater than 255 …7.5
- CVE-2020-7690All affected versions <2.0.0 of package jspdf are vulnerable…6.1
- CVE-2020-7691In all versions of the package jspdf, it is possible to use …6.1
Are you affected by CVE-2020-7685?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST