CVE-2020-5840

2020-01-0618:15:24

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.1%

JSON

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.

CPENameOperatorVersion
hashbrown-cmseq0.7.2
hashbrown-cmseq0.10.2
hashbrown-cmseq1.2.2
hashbrown-cmseq1.3.1
hashbrown-cmseq1.0.7
hashbrown-cmseq0.10.1
hashbrown-cmseq0.7.1
hashbrown-cmseq1.1.4
hashbrown-cmseq0.9.3
hashbrown-cmseq0.9.6

Name	Operator	Version
hashbrown-cms	eq	0.7.2
hashbrown-cms	eq	0.10.2
hashbrown-cms	eq	1.2.2
hashbrown-cms	eq	1.3.1
hashbrown-cms	eq	1.0.7
hashbrown-cms	eq	0.10.1
hashbrown-cms	eq	0.7.1
hashbrown-cms	eq	1.1.4
hashbrown-cms	eq	0.9.3
hashbrown-cms	eq	0.9.6