CVE-2020-12852: Input Validation
First published: Thu Jun 04 2020(Updated: )
The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named “pydio”.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pydio Cells | =2.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-12852?
CVE-2020-12852 is a vulnerability in Pydio Cells 2.0.4 that allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package.
How does CVE-2020-12852 affect Pydio Cells 2.0.4?
CVE-2020-12852 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package, potentially leading to unauthorized updates or malicious code execution.
What is the severity of CVE-2020-12852?
CVE-2020-12852 has a severity rating of 6.8 (high).
How can I fix CVE-2020-12852 in Pydio Cells 2.0.4?
To fix CVE-2020-12852 in Pydio Cells 2.0.4, it is recommended to update the software to a version that does not have this vulnerability.
Where can I find more information about CVE-2020-12852?
More information about CVE-2020-12852 can be found at the following references: [http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html](http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html), [https://www.coresecurity.com/advisories](https://www.coresecurity.com/advisories), [https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities](https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- vendor/pydio
- canonical/pydio cells
- version/pydio cells/2.0.4