Arbitrary file upload in Umbraco CMS - CVE-2020-9472
Published: March 16, 2020 / Updated: April 18, 2021
Vulnerability identifier: #VU34732
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9472
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
Affected software
Umbraco CMS
How to mitigate CVE-2020-9472
Install update from vendor's website.