A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:38
Type | Values Removed | Values Added |
---|---|---|
References | () https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release - Vendor Advisory | |
References | () https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/ - Third Party Advisory |
Information
Published : 2020-03-17 14:15
Updated : 2024-11-21 04:38
NVD link : CVE-2019-20452
Mitre link : CVE-2019-20452
CVE.ORG link : CVE-2019-20452
JSON object : View
Products Affected
pydio
- pydio
CWE
CWE-502
Deserialization of Untrusted Data