CVE-2020-15188

Katalog CVE

CVSS 9.8 · Critical EPSS 5,1%

Kerentanan Deserialization of Untrusted Data pada brassica soy cms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.

Rincian

Terbit di NVD

18 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

5,1% peluang dieksploitasi; lebih tinggi dari 92,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inunosinsi/soycms/pull/12/commits/a75642989132dd25f74a13194b27c0986c3de020 patch · advisory pihak ketiga
• https://github.com/inunosinsi/soycms/issues/10 exploit · advisory pihak ketiga
• https://github.com/inunosinsi/soycms/security/advisories/GHSA-hrrx-m22r-p9jp exploit · advisory pihak ketiga
• https://www.youtube.com/watch?v=zAE4Swjc-GU&feature=youtu.be exploit · advisory pihak ketiga