CVE-2020-24136

2021-04-0715:15:12

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.

CPENameOperatorVersion
wcmseq1.1.3
wcmseq0.1.6
wcmseq0.2.6
wcmseq0.1.3
wcmseq0.3.0
wcmseq0.1.1
wcmseq0.1.5
wcmseq0.1.2
wcmseq0.1.2.1
wcmseq0.2.2

Name	Operator	Version
wcms	eq	1.1.3
wcms	eq	0.1.6
wcms	eq	0.2.6
wcms	eq	0.1.3
wcms	eq	0.3.0
wcms	eq	0.1.1
wcms	eq	0.1.5
wcms	eq	0.1.2
wcms	eq	0.1.2.1
wcms	eq	0.2.2

Rows per page:

1-10 of 331

References

github.com/secwx/research/blob/main/cve/CVE-2020-24136.md

github.com/vedees/wcms/issues/12