CVE-2020-24914: Critical severity qcubed qcubed vulnerability

Q: What is the severity of CVE-2020-24914?

CVE-2020-24914 is classified as a critical vulnerability due to the potential for unauthenticated remote code execution.

Q: How do I fix CVE-2020-24914?

To fix CVE-2020-24914, upgrade Qcubed to version 3.2 or later.

Q: Who is affected by CVE-2020-24914?

All versions of Qcubed, including 3.1.1, are affected by CVE-2020-24914.

Q: What type of vulnerability is CVE-2020-24914?

CVE-2020-24914 is a PHP object injection vulnerability.

Q: Can CVE-2020-24914 be exploited remotely?

Yes, CVE-2020-24914 can be exploited remotely by an unauthenticated attacker via a malicious POST request.

Published Mar 4, 2021

Updated

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

Affected Software

2 affected componentsFixes available

composer/qcubed/qcubed<=3.1.1

3.2

qcubed qcubed<=3.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/qcubed/qcubed to a version that resolves this vulnerability.
Fixed in 3.2

Event History

Mar 4, 2021

CVE Published

via MITRE·12:33 PM

Data Sourced

via MITRE·12:33 PM

Description

Data Sourced

via NVD·01:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·05:43 PM

Frequently Asked Questions

What is the severity of CVE-2020-24914?

CVE-2020-24914 is classified as a critical vulnerability due to the potential for unauthenticated remote code execution.

How do I fix CVE-2020-24914?