CVE-2020-29592 File upload in n/a
Attackers can upload dangerous executables via the TinyMCE editor in Orchard CMS, bypassing file type restrictions to potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-29592?
CVE-2020-29592 is a critical vulnerability in n/a, published on 14 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list in Media settings).
Weakness: CWE-434
Which versions are affected by CVE-2020-29592?
It affects 1 product.
Products include Orchardproject Orchard.
How do I fix CVE-2020-29592?
No fix has been published for CVE-2020-29592 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-29592 being exploited?
There is no known exploitation of CVE-2020-29592 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f293-4f7m-q7rj.