A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
References
Link | Resource |
---|---|
https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release | Vendor Advisory |
https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2020-03-17 14:15
Updated : 2024-02-28 17:47
NVD link : CVE-2019-20452
Mitre link : CVE-2019-20452
CVE.ORG link : CVE-2019-20452
JSON object : View
Products Affected
pydio
- pydio
CWE
CWE-502
Deserialization of Untrusted Data