nvd-json-data-feeds/CVE-2020/CVE-2020-260xx/CVE-2020-26048.json

{
  "id": "CVE-2020-26048",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-10-05T15:15:12.170",
  "lastModified": "2024-11-21T05:19:06.003",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "La opci\u00f3n file manager en CuppaCMS versiones anteriores al 12-11-2019, permite a un atacante autenticado cargar un archivo malicioso dentro de una extensi\u00f3n de imagen y, por medio de una petici\u00f3n personalizada, usando la funci\u00f3n rename proporcionada mediante el administrador de archivos, es capaz de modificar la extensi\u00f3n de la imagen a PHP, resultando en una ejecuci\u00f3n de c\u00f3digo arbitraria remota"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cuppacms:cuppacms:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2019-11-12",
              "matchCriteriaId": "D8ED1BEA-DDC5-4FB0-BD5B-B8BED225773A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/CuppaCMS/CuppaCMS/issues/7",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/CuppaCMS/CuppaCMS/issues/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}