CVE-2020-35627

{"id": "CVE-2020-35627", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-12-28T15:15:12.483", "references": [{"url": "https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://makewebbetter.com/product/giftware-woocommerce-gift-cards/", "tags": ["Product", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function \"Custom Gift Card Template\", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server."}, {"lang": "es", "value": "Ultimate WooCommerce Gift Cards versi\u00f3n 3.0.2, est\u00e1 afectada por una vulnerabilidad de carga de archivos en la Custom GiftCard Template que puede ejecutar remotamente c\u00f3digo arbitrario. Una vez que contiene la funci\u00f3n \"Custom Gift Card Template\", la funci\u00f3n de cargar una imagen personalizada es usada, cambiando el nombre de la extensi\u00f3n de la imagen a PHP y ejecutando el c\u00f3digo PHP en el servidor"}], "lastModified": "2020-12-30T16:44:01.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:woocommerce:gift_cards:3.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED2C0316-B33F-456C-BFFB-463578631107"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}