CVE-2020-36082 File upload in n/a

Critical 9.8 Published 11 Aug 2023 Updated 9 Oct 2024

Remote attackers can execute arbitrary code and escalate privileges by uploading a crafted webshell file to bloofoxCMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-36082?

CVE-2020-36082 is a critical vulnerability in n/a, published on 11 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module.

Weakness: CWE-434

Which versions are affected by CVE-2020-36082?

It affects 1 product.

Products include Bloofox Bloofoxcms.

How do I fix CVE-2020-36082?

No fix has been published for CVE-2020-36082 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36082 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36082 exists.

Sources

Also known as GHSA-x78j-rvfq-r7vw.