CVE-2020-15188 | SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated… | CVSS 10.0 CRITICAL

Description

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.

Metadata

CVE ID: CVE-2020-15188
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2020-06-25 00:00 UTC
Published: 2020-09-18 17:05 UTC
Last updated: 2024-08-04 13:08 UTC
Primary CWE: CWE-502
{"CWE-502":"Deserialization of Untrusted Data"}
Vendor / Product: inunosinsi / soycms
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
inunosinsi	soycms	—	< 3.0.2.328

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	{"CWE-502":"Deserialization of Untrusted Data"}

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (4)