CVE-2020-10212

{"id": "CVE-2020-10212", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-03-07T00:15:13.117", "references": [{"url": "https://github.com/trippo/ResponsiveFilemanager/issues/598", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728."}, {"lang": "es", "value": "El archivo upload.php en Responsive FileManager versiones 9.13.4 y 9.14.0, permite un ataque de tipo SSRF por medio del par\u00e1metro url porque el bloqueo de la extensi\u00f3n de archivo se maneja inapropiadamente y porque es posible que un nombre de host DNS se resuelva en una direcci\u00f3n IP interna. Por ejemplo, un intento de SSRF puede tener \u00e9xito si un nombre de archivo .ico es agregado al PATH_INFO. Adem\u00e1s, un atacante podr\u00eda crear un nombre de host DNS que se resuelva en la direcci\u00f3n IP 0.0.0.0 para una DNS pinning. NOTA: este problema se presenta debido a una correcci\u00f3n incompleta para CVE-2018-14728."}], "lastModified": "2020-03-09T16:56:27.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tecrail:responsive_filemanager:9.13.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E5817FB-89FD-4B34-A47F-F42E3B5756A1"}, {"criteria": "cpe:2.3:a:tecrail:responsive_filemanager:9.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07160113-5BCB-4E2F-9B56-B4DAABAA9933"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}