CVE-2020-12847

{"id": "CVE-2020-12847", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2020-06-04T20:15:11.737", "references": [{"url": "http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.coresecurity.com/advisories", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.coresecurity.com/advisories", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Pydio Cells 2.0.4 web application offers an administrative console named \u201cCells Console\u201d that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application\u2019s mailer configuration. It is possible to configure a few engines to be used by the mailer application to send emails. If the user selects the \u201csendmail\u201d option as the default one, the web application offers to edit the full path where the sendmail binary is hosted. Since there is no restriction in place while editing this value, an attacker authenticated as an administrator user could force the web application into executing any arbitrary binary."}, {"lang": "es", "value": "La aplicaci\u00f3n web Pydio Cells versi\u00f3n 2.0.4, ofrece una consola administrativa llamada \u201cCells Console\u201d que est\u00e1 disponible para los usuarios con un rol de administrador. Esta consola ofrece a un usuario administrador la posibilidad de cambiar varias configuraciones, incluyendo la configuraci\u00f3n del mailer de la aplicaci\u00f3n. Es posible configurar algunos motores para que la aplicaci\u00f3n mailer los use para enviar correos electr\u00f3nicos. Si el usuario selecciona la opci\u00f3n \"sendmail\" como predeterminada, la aplicaci\u00f3n web ofrece editar la ruta completa donde se aloja el binario de sendmail. Como no existe ninguna restricci\u00f3n al editar este valor, un atacante autenticado como usuario administrador podr\u00eda forzar a la aplicaci\u00f3n web a ejecutar cualquier binario arbitrario"}], "lastModified": "2024-11-21T05:00:23.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pydio:cells:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DD71F82-734C-4DDA-B136-C26C71116D01"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}