CVEvulnerability
CVE-2020-29607
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-12-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
Affected configurations
• pluck-cms pluck (< 4.7.13)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- http://packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit Exploit, Third Party Advisory
- https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-29607.md github.com
- https://github.com/pluck-cms/pluck/issues/96 Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit Exploit, Third Party Advisory
- https://github.com/pluck-cms/pluck/issues/96 Exploit, Third Party Advisory