CVE-2020-21055: Path Traversal
Published May 20, 2021
·Updated
A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variables in app\edit\filerename.php.
Affected Software
1 affected component
FusionPBX Fusionpbx=4.5.7
Remediation
Event History
May 20, 2021
CVE Published
via MITRE·03:42 PM
Data Sourced
via MITRE·03:42 PM
Description
Frequently Asked Questions
1
What is CVE-2020-21055?
CVE-2020-21055 is a Directory Traversal vulnerability in FusionPBX 4.5.7 that allows malicious users to rename any file on the system.
2
How can a malicious user exploit CVE-2020-21055?
A malicious user can exploit CVE-2020-21055 by manipulating the folder, filename, and newfilename variables in app\edit\filerename.php.
3
What is the severity of CVE-2020-21055?
CVE-2020-21055 has a severity value of 6.5, indicating a medium severity.
4
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-21055?
The Common Weakness Enumeration (CWE) ID for CVE-2020-21055 is CWE-22.
5
How can I fix CVE-2020-21055?
To fix CVE-2020-21055, update FusionPBX to version 4.5.8 or later, which contains a fix for the vulnerability.