Arbitrary file upload in Umbraco CMS - CVE-2020-9471
Published: March 16, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34731
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9471
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to execute arbitrary code.
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
Affected software
Umbraco CMS
How to mitigate CVE-2020-9471
Install update from vendor's website.