CVE-2020-13443

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft…

published June 24, 2020

CVSS
—
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead, direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access, or registration/forum is enabled and one can create a member with the default group id of 5. To exploit this, one must to be able to send and compose messages (at least).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04131 · 90.8th percentile
Published
2020-06-24T14:34Z
EPSS history
Timeline
  • 24 JUN 14:34Z
    ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft…
    cvelistv5