CVE-2020-19902 Path traversal in n/a
A remote attacker can execute arbitrary code via a directory traversal vulnerability in the wex/cssjs.php parameter of Cryptoprof WCMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-19902?
CVE-2020-19902 is a critical path traversal vulnerability in n/a, published on 27 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter.
Weakness: CWE-22
Which versions are affected by CVE-2020-19902?
It affects 1 product.
Products include Wcms Wcms.
How do I fix CVE-2020-19902?
No fix has been published for CVE-2020-19902 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-19902 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-19902 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h7fv-hhvw-364h.