hashbrowncms/hashbrown-cms · Security
HashBrown CMS Directory Traversal
- GHSA ID
- GHSA-q7hx-mrv5-6mrp
- CVE ID
- CVE-2020-5840
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-5840 ↗
- https://github.com/HashBrownCMS/hashbrown-cms/compare/v1.3.1...v1.3.2 ↗
- https://github.com/HashBrownCMS/hashbrown-cms/releases/tag/v1.3.2 ↗
- https://github.com/HashBrownCMS/hashbrown-cms/commit/6b37b73944447bb29c6aaeb086b04196d80c692a ↗
- https://github.com/advisories/GHSA-q7hx-mrv5-6mrp ↗