Lucene search

[email protected]CVE-2020-28687

HistoryNov 17, 2020 - 2:15 p.m.

CVE-2020-28687

2020-11-1714:15:11

CWE-434

[email protected]

web.nvd.nist.gov

cve-2020-28687

artworks gallery

php

css

javascript

mysql

file upload vulnerability

remote attack

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.025 Low

EPSS

Percentile

90.3%

JSON

The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.

Affected configurations

NVD

Node

artworks_gallery_in_php\,_css\,_javascript\,_and_mysql_projectartworks_gallery_in_php\,_css\,_javascript\,_and_mysqlMatch1.0

CPENameOperatorVersion
artworks_gallery_in_php\,_css\,_javascript\,_and_mysql_project:artworks_gallery_in_php\,_css\,_javascript\,_and_mysqlartworks gallery in php, css, javascript, and mysql project artworks gallery in php, css, javascript, and mysqleq1.0

CPE	Name	Operator	Version
artworks_gallery_in_php\,_css\,_javascript\,_and_mysql_project:artworks_gallery_in_php\,_css\,_javascript\,_and_mysql	artworks gallery in php, css, javascript, and mysql project artworks gallery in php, css, javascript, and mysql	eq	1.0

References

code-projects.org/artworks-gallery-in-php-css-javascript-and-mysql-free-download/

packetstormsecurity.com/files/160095/Artworks-Gallery-1.0-Shell-Upload.html

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.025 Low

EPSS

Percentile

90.3%

JSON

Related for CVE-2020-28687

nvd1 prion1 cvelist1 exploitdb1 packetstorm1