CVE-2020-24948 File upload in n/a
High-privilege users can upload arbitrary files via the import feature, leading to remote command execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24948?
CVE-2020-24948 is a high-severity vulnerability in n/a, published on 3 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
Weakness: CWE-434
Which versions are affected by CVE-2020-24948?
It affects 1 product.
Products include Autoptimize Autoptimize.
How do I fix CVE-2020-24948?
No fix has been published for CVE-2020-24948 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-24948 being exploited?
There is no known exploitation of CVE-2020-24948 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-24376 Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"
- CVE-2021-24377 Autoptimize < 2.7.8 - Race Condition leading to RCE
- CVE-2023-2113 Autoptimize < 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings Import
- CVE-2022-2635 Autoptimize < 3.1.1 - Admin+ Stored Cross Site Scripting
- CVE-2021-24378 Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload
Sources
Also known as GHSA-rx6v-3mjq-w67p.