CVE-2020-17564

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php"…

published April 22, 2021

CVSS
—
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

⚠️ A sneaky path traversal vulnerability lets attackers delete files remotely with a simple crafted request! 🔥 Think of this like a restaurant where a clever patron manages to skip the line and sneak into the kitchen, throwing away any ingredient they don’t like – very dangerous! An attacker could potentially wipe out vital files on your server, leading to data loss or even service disruption. This could be absolutely devastating for your application and users, so it’s crucial to act quickly!

Put simply

Think of this like a restaurant where a clever patron manages to skip the line and sneak into the kitchen, throwing away any ingredient they don’t like – very dangerous! This path traversal vulnerability in FeiFeiCMS v4.0 allows attackers to manipulate file paths, enabling them to send requests that delete files they shouldn’t have access to.

What to do

An attacker could potentially wipe out vital files on your server, leading to data loss or even service disruption. This could be absolutely devastating for your application and users, so it’s crucial to act quickly! To safeguard your system, update FeiFeiCMS to the latest version immediately and ensure proper input validation is in place. It's also wise to review your access control settings to restrict file deletion rights. You've got this! With a few simple updates, you can keep your system secure and ready to roll! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02601 · 85.2th percentile
Published
2021-04-22T21:21Z
EPSS history
Timeline
  • 22 APR 21:21Z
    Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php"…
    cvelistv5