Arbitrary File Deletion in Wuzhi CMS by Beijing Wuzhi Internet Technology Co., Ltd.
CVE-2020-24930

8.1HIGH

Key Information:

Vendor

Wuzhicms

Status
Wuzhicms
Vendor
CVE Published:
27 September 2021

What is CVE-2020-24930?

An arbitrary file deletion vulnerability exists in Wuzhi CMS 4.0.1 due to improper handling of user inputs in the CMS backend. This flaw allows attackers to exploit the issue and delete any arbitrary file from the server, potentially leading to data loss and service disruption. Organizations using this version of Wuzhi CMS should take immediate steps to evaluate their security posture and apply necessary updates to safeguard against possible attacks.

References

https://github.com/wuzhicms/wuzhicms/issues/191
x_refsource_MISC
https://www.cnvd.org.cn/flaw/show/2394661
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2020-24930 : Arbitrary File Deletion in Wuzhi CMS by Beijing Wuzhi Internet Technology Co., Ltd.