CVE-2020-22249: Malicious File Upload
Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the remote code execution
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-22249?
CVE-2020-22249 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2020-22249?
To fix CVE-2020-22249, upgrade phplist to version 3.5.2 or later where the vulnerability has been addressed.
What are the consequences of exploiting CVE-2020-22249?
Exploitation of CVE-2020-22249 can lead to unauthorized remote code execution on the affected server.
In which version of phplist is CVE-2020-22249 present?
CVE-2020-22249 is present in phplist version 3.5.1.
Can CVE-2020-22249 affect other versions of phplist?
CVE-2020-22249 specifically affects phplist 3.5.1, and other versions may not be impacted unless they share the same vulnerability.