CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead

published April 15, 2020

CVSS
—
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01729 · 77.4th percentile
Published
2020-04-15T20:18Z
EPSS history
Timeline
  • 15 APR 20:18Z
    In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead
    cvelistv5