Vulnerability Description
Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jaws Project | Jaws | <= 1.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/jaws-project/jawsThird Party Advisory
- https://github.com/xNoBody12/jaws-rce-via-themeExploitThird Party Advisory
- https://github.com/jaws-project/jawsThird Party Advisory
- https://github.com/xNoBody12/jaws-rce-via-themeExploitThird Party Advisory
FAQ
What is CVE-2020-35657?
CVE-2020-35657 is a vulnerability with a CVSS score of 7.2 (HIGH). Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS c...
How severe is CVE-2020-35657?
CVE-2020-35657 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-35657?
Check the references section above for vendor advisories and patch information. Affected products include: Jaws Project Jaws.