CVE-2020-12832 Path traversal in n/a
Attackers can delete arbitrary files on the server due to improper input validation in the Simple File List plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12832?
CVE-2020-12832 is a critical path traversal vulnerability in n/a, published on 13 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Weakness: CWE-22
Which versions are affected by CVE-2020-12832?
It affects 1 product.
Products include Simplefilelist Simple-File-List.
How do I fix CVE-2020-12832?
No fix has been published for CVE-2020-12832 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-12832 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-12832 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h2cg-59q7-cp5x.