CVE-2020-9423 File upload in n/a
Unauthenticated attackers can upload arbitrary files to execute commands with root privileges or access database data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9423?
CVE-2020-9423 is a critical vulnerability in n/a, published on 18 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges.
Weakness: CWE-434
Which versions are affected by CVE-2020-9423?
It affects 1 product.
Products include Logicaldoc Logicaldoc.
How do I fix CVE-2020-9423?
No fix has been published for CVE-2020-9423 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9423 being exploited?
There is no known exploitation of CVE-2020-9423 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qgmc-9h97-pfv6.