CVE-2020-12849 — MEDIUM (5.4)

Vulnerability Description

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Pydio	Cells	2.0.4

Related Weaknesses (CWE)

CWE-79

References

http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-CodExploitThird Party Advisory
https://www.coresecurity.com/advisoriesThird Party Advisory
https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulneThird Party Advisory
http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-CodExploitThird Party Advisory
https://www.coresecurity.com/advisoriesThird Party Advisory
https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulneThird Party Advisory

FAQ

What is CVE-2020-12849?

CVE-2020-12849 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated U...

How severe is CVE-2020-12849?

CVE-2020-12849 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-12849?

Check the references section above for vendor advisories and patch information. Affected products include: Pydio Cells.