CVE-2020-23653: Critical severity thinkadmin vulnerability
An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
Other sources
An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-23653?
CVE-2020-23653 is an insecure unserialize vulnerability found in ThinkAdmin versions 4.x through 6.x.
What is the severity of CVE-2020-23653?
The severity of CVE-2020-23653 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2020-23653?
ThinkAdmin versions 4.x through 6.x are affected by CVE-2020-23653.
How can CVE-2020-23653 be exploited?
CVE-2020-23653 can be exploited through insecure unserialize in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, potentially leading to arbitrary remote code execution.
Is there a fix available for CVE-2020-23653?
To fix CVE-2020-23653, update ThinkAdmin to a version higher than 6.0.