CVE-2020-23352: High severity z-blog vulnerability

Published Jan 27, 2021

Updated

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword() uses loose comparison to authenticate, which can be bypassed via magic hash values.

Affected Software

1 affected component

ZblogCN Z-blogphp=1.6.0

Remediation

Patch Available

https://github.com/zblogcn/zblogphp/commit/a67607fc984f976d6b36b8870dffaabd9d6c9d5e

Event History

Jan 27, 2021

CVE Published

via MITRE·03:25 PM

Data Sourced

via MITRE·03:25 PM

Description

Frequently Asked Questions

What is the vulnerability ID for Z-BlogPHP?

The vulnerability ID for Z-BlogPHP is CVE-2020-23352.

What is the severity of CVE-2020-23352?

The severity of CVE-2020-23352 is high with a severity value of 7.5.

How does CVE-2020-23352 affect Z-BlogPHP?

CVE-2020-23352 affects Z-BlogPHP by allowing bypass of authentication via PHP loose comparison and magic hash values.

How can the incorrect access control vulnerability be exploited in Z-BlogPHP?

The incorrect access control vulnerability in Z-BlogPHP can be exploited by using PHP loose comparison and a magic hash to bypass authentication.

Is there a fix available for CVE-2020-23352?

Yes, a fix for CVE-2020-23352 is available. Please refer to the official reference for more details.