1. Home
  2. CVE Database
  3. CVE-2020-29592
CRITICAL · 9.8

CVE-2020-29592

An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables th...

Vulnerability Description

An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list in Media settings).

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
OrchardprojectOrchard< 1.10

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2020-29592?

CVE-2020-29592 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables th...

How severe is CVE-2020-29592?

CVE-2020-29592 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-29592?

Check the references section above for vendor advisories and patch information. Affected products include: Orchardproject Orchard.