CVE-2020-37117: jizhiCMS 1.6.7 - Arbitrary File Download
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and downloadurl parameters to trigger unauthorized file downloads.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37117?
CVE-2020-37117 has a medium severity rating due to its potential for file download exploitation by authenticated administrators.
How do I fix CVE-2020-37117?
To fix CVE-2020-37117, ensure that your jizhiCMS version is updated to a patched release that addresses the file download vulnerability.
Who is affected by CVE-2020-37117?
Authenticated administrators using jizhiCMS 1.6.7 are affected by CVE-2020-37117 and should take immediate action.
What kind of attack can be executed using CVE-2020-37117?
CVE-2020-37117 allows attackers to exploit the vulnerability by sending crafted POST requests that enable arbitrary file downloads.
Is CVE-2020-37117 a remote or local vulnerability?
CVE-2020-37117 is considered a local vulnerability, as it requires authenticated access to exploit the file download functionality.