nvd-json-data-feeds/CVE-2020/CVE-2020-105xx/CVE-2020-10557.json

{
  "id": "CVE-2020-10557",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-03-16T15:15:12.583",
  "lastModified": "2020-03-18T19:07:51.180",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en AContent versiones hasta 1.4. Permite a un usuario ejecutar comandos en el servidor con una cuenta poco privilegiada. La secci\u00f3n de carga en la p\u00e1gina del administrador de archivos contiene una vulnerabilidad de carga de archivos arbitraria mediante el archivo upload.php. La extensi\u00f3n .php7 omite las restricciones de carga de archivos."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:atutor:acontent:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.4",
              "matchCriteriaId": "C9D13404-3B30-45F8-A829-7FCF1C565508"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cinzinga/CVEs/tree/master/CVE-2020-10557",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://sourceforge.net/projects/acontent/",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}