CVE-2020-10560

OSSN prior to 5.3 is vulnerable to an unauthenticated arbitrary file read. A user-controlled file path combined with a weak cryptographic SiteKey can be brute-forced to craft a URL that targets components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php, allowing reading arbitrary ...