CVE-2019-20453

2020-03-1714:15:11

Google

osv.dev

8 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.4%

JSON

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.

CPENameOperatorVersion
pydio-coreeqpydio-core-6.4.1
pydio-coreeqpydio-core-8.0.1
pydio-coreeqpydio-core-6.0.6
pydio-coreeqpydio-core-6.0.8
pydio-coreeqpydio-core-8.2.2
pydio-coreeqpydio-core-5.3.4
pydio-coreeqpydio-core-6.4.2
pydio-coreeqajaxplorer-core-4.3.1
pydio-coreeqpydio-core-7.0.0
pydio-coreeqpydio-core-6.4.2rc1

Name	Operator	Version
pydio-core	eq	pydio-core-6.4.1
pydio-core	eq	pydio-core-8.0.1
pydio-core	eq	pydio-core-6.0.6
pydio-core	eq	pydio-core-6.0.8
pydio-core	eq	pydio-core-8.2.2
pydio-core	eq	pydio-core-5.3.4
pydio-core	eq	pydio-core-6.4.2
pydio-core	eq	ajaxplorer-core-4.3.1
pydio-core	eq	pydio-core-7.0.0
pydio-core	eq	pydio-core-6.4.2rc1