CVE-2020-7830 Path traversal in RAON KUpload
Remote attackers can download files to arbitrary paths due to insufficient validation, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7830?
CVE-2020-7830 is a high-severity path traversal vulnerability in RAONWIZ RAON KUpload, published on 2 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in downloading with Kupload agent allow files to be downloaded to arbitrary paths due to insufficient verification of extensions and download paths. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions and earlier.
Weakness: CWE-20
Which versions are affected by CVE-2020-7830?
It affects 1 product.
Products include Raonwiz Raon Kupload.
How do I fix CVE-2020-7830?
No fix has been published for CVE-2020-7830 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-7830 being exploited?
There is no known exploitation of CVE-2020-7830 in the wild and no public exploit code.
Sources
Also known as GHSA-qr8m-vjgf-5975.