Arbitrary file upload in Super File Explorer - CVE-2020-7998
Published: January 28, 2020
Vulnerability identifier: #VU24698
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2020-7998
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: chen lili
Affected software:
Super File Explorer
Super File Explorer
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file extension when uploading files in the developer path that is accessible and hidden next to the root path. A remote attacker can upload and execute arbitrary file on the system.
How to mitigate CVE-2020-7998
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..