Arbitrary file upload in Super File Explorer - CVE-2020-7998
Published: January 28, 2020
Vulnerability identifier: #VU24698
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-7998
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file extension when uploading files in the developer path that is accessible and hidden next to the root path. A remote attacker can upload and execute arbitrary file on the system.
Affected software
Super File Explorer
How to mitigate CVE-2020-7998
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..