Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
silverstripeCMS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-9280) - Vulnerability Database

silverstripeCMS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-9280)

Description

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x.

References

CVE-2020-9280

Related Vulnerabilities

Artifactory Improper Privilege Management Vulnerability (CVE-2022-0668) Critical
Common tags: Missing Update Known Vulnerabilities
SharePoint Download of Code Without Integrity Check Vulnerability (CVE-2020-1453) High
Common tags: Missing Update Known Vulnerabilities
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-1345) Medium
Common tags: Missing Update Known Vulnerabilities
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2020-1439) High
Common tags: Missing Update Known Vulnerabilities
SharePoint CVE-2020-1440 Vulnerability (CVE-2020-1440) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

High

Classification

CVE-2020-9280
CWE-434
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update
Known Vulnerabilities