CVE-2020-25359

Katalog CVE

CVSS 9.1 · Critical EPSS 2,3%

Kerentanan Missing Authorization pada rconfig. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delete all the files with that extension in that path.

Rincian

Terbit di NVD

20 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cwe.mitre.org/data/definitions/36.html advisory pihak ketiga
• https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html exploit · advisory pihak ketiga