CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list

High · published December 18, 2020

CVSS v3.1
8.8
EPSS
1%
Percentile
69.2
In the wild
Unconfirmed
What it is

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser (client-side) and can be circumvented. This allows an attacker to upload any file as an attachment to a workitem.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01249 · 69.2th percentile
Published
2020-12-18T09:27Z
EPSS history
Timeline
  • 18 DEC 09:27Z
    tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list
    cvelistv5