CVE-2020-26804

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab

published November 12, 2020

CVSS
—
EPSS
1%
Percentile
72.5
In the wild
Unconfirmed
What it is

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01411 · 72.5th percentile
Published
2020-11-12T18:52Z
EPSS history
Timeline
  • 12 NOV 18:52Z
    In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab
    cvelistv5