CVE-2020-21523: Critical severity halo vulnerability
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign test="freemarker.template.utility.Execute"?new()> ${test("touch /tmp/freemarkerPwned")}
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-21523?
CVE-2020-21523 is considered to have high severity due to its potential for arbitrary code execution.
How do I fix CVE-2020-21523?
To fix CVE-2020-21523, upgrade Halo CMS to the latest patched version beyond 1.1.3.
What causes the vulnerability in CVE-2020-21523?
CVE-2020-21523 is caused by a Server-Side Freemarker template injection vulnerability that allows manipulation of ftl files.
Which versions of Halo CMS are affected by CVE-2020-21523?
CVE-2020-21523 affects Halo CMS version 1.1.3.
What are the potential impacts of exploiting CVE-2020-21523?
Exploiting CVE-2020-21523 could lead to arbitrary code execution on the server, compromising the integrity and security of the application.