Directory Traversal Vulnerability in Processwire CMS by Processwire
CVE-2020-27467

7.5HIGH

Key Information:

Vendor

Processwire

Status
Processwire
Vendor
CVE Published:
24 February 2022

What is CVE-2020-27467?

A Directory Traversal vulnerability was discovered in Processwire CMS prior to version 2.7.1, which allows attackers to manipulate the 'download' parameter in index.php. This exploitation could enable unauthorized access to sensitive files on the server, compromising the confidentiality and integrity of the data. It highlights the importance of regular updates and secure coding practices to mitigate potential risks.

References

https://github.com/ceng-yildirim/LFI-processwire
x_refsource_MISC

EPSS Score

86% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.