CVE-2020-11817 File upload in n/a
Attackers can upload arbitrary files and execute commands on Rukovoditel servers when Maintenance Mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11817?
CVE-2020-11817 is a critical vulnerability in Rukovoditel Rukovoditel, published on 27 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs with the Maintenance Mode setting.
Weakness: CWE-434
Which versions are affected by CVE-2020-11817?
It affects 1 product.
Products include Rukovoditel Rukovoditel.
How do I fix CVE-2020-11817?
No fix has been published for CVE-2020-11817 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-11817 being exploited?
There is no known exploitation of CVE-2020-11817 in the wild and no public exploit code.
Other vulnerabilities in Rukovoditel Rukovoditel
Sources
Also known as GHSA-g449-3r9g-f763.