CVE-2020-15188 Unauthenticated Remote Code Execution in SOY CMS
Remote attackers can execute arbitrary code via unsafe deserialization in the inquiry form feature, requiring the feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15188?
CVE-2020-15188 is a critical unsafe deserialization vulnerability in inunosinsi soycms, published on 18 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.
Weakness: CWE-502
Which versions are affected by CVE-2020-15188?
It affects 1 product.
Products include Brassica Soy Cms.
How do I fix CVE-2020-15188?
No fix has been published for CVE-2020-15188 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-15188 being exploited?
There is no known exploitation of CVE-2020-15188 in the wild and no public exploit code.