CVE-2020-35951 Missing authorization in n/a

Critical 9.9 Published 1 Jan 2021 Updated 4 Aug 2024

Unauthenticated attackers can delete arbitrary files, including configuration files, causing site downtime and potential reinstallation under attacker control.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-35951?

CVE-2020-35951 is a critical missing authorization vulnerability in n/a, published on 1 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Weakness: CWE-306

Which versions are affected by CVE-2020-35951?

It affects 1 product.

Products include Expresstech Quiz and Survey Master.

How do I fix CVE-2020-35951?

No fix has been published for CVE-2020-35951 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-35951 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35951 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-r275-5g72-r3ph.