File Upload Vulnerability in Pluck CMS by Pluck CMS
CVE-2020-20919

7.2HIGH

Key Information:

Vendor

Pluck-cms

Status
Pluck
Vendor
CVE Published:
20 June 2023

What is CVE-2020-20919?

A file upload vulnerability exists in Pluck CMS v4.7.10-dev2 that permits attackers to upload malicious files through the theme.php file. This flaw could lead to unauthorized remote code execution, allowing attackers to manipulate the server and potentially access sensitive data. Organizations using affected versions of Pluck CMS should take immediate action to mitigate this risk.

References

https://github.com/pluck-cms/pluck/issues/85

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.