CVE-2020-9280
In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - cve@mitre.org
- Published
- 2020-04-15
- Last modified
- 2024-08-04
- Weaknesses
- CWE-434
Affected products
References
- https://forum.silverstripe.org/c/releases
- https://www.silverstripe.org/download/security-releases/
- https://www.silverstripe.org/download/security-releases/cve-2020-9280
