CVE-2020-7685: Insecure Defaults

Published Jul 28, 2020

Updated

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.

Affected Software

1 affected component

Umbraco Umbraco Forms

Event History

Jul 28, 2020

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability in UmbracoForms?

UmbracoForms allows the upload of arbitrary file types when using the default configuration for upload forms.

How does UmbracoForms mitigate the vulnerability?

Users can create a custom workflow and frontend validation to block the upload of arbitrary file types.

Which versions of UmbracoForms are affected by this vulnerability?

All versions of UmbracoForms are affected by this vulnerability.

What is the severity of CVE-2020-7685?

The severity of CVE-2020-7685 is high with a CVSS score of 7.5.

Is there any reference for CVE-2020-7685?

Yes, you can find more information about CVE-2020-7685 at https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765.