CVE-2020-15189
Medium
Description
SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.
SeverityMedium
CVSS6.8
Exploit probability—
ProductBrassica Soy Cms
PublishedSep 18, 2020
First seenSep 18, 2020
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- brassica soy_cms3.0.2.328 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| brassica soy_cms | v < 3.0.2.328 | 3.0.2.328 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.