CVE-2020-15026: Path Traversal

Published Jun 24, 2020

Updated

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php.

Affected Software

1 affected component

Bludit bludit=3.12.0

Remediation

Patch Available

https://github.com/bludit/bludit/issues/1214

Event History

Jun 24, 2020

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

Description

Frequently Asked Questions

What is CVE-2020-15026?

CVE-2020-15026 is a vulnerability that allows admins of Bludit 3.12.0 to perform directory traversal and download arbitrary files via the /plugin-backup-download?file=../ endpoint.

What is the severity of CVE-2020-15026?

The severity of CVE-2020-15026 is medium with a CVSS score of 4.9.

How does CVE-2020-15026 affect Bludit?

CVE-2020-15026 affects Bludit 3.12.0 by enabling admins to perform directory traversal and download arbitrary files.

How can a hacker exploit CVE-2020-15026?

A hacker can exploit CVE-2020-15026 by manipulating the /plugin-backup-download?file=../ parameter to download sensitive files from the server.

Is there a fix available for CVE-2020-15026?

Yes, the fix for CVE-2020-15026 is to upgrade to a version of Bludit that is not affected by the vulnerability.