GitHub Advisoryadvisory · NuGet

GHSA-8m73-w2r2-6xxj Insecure defaults in UmbracoForms

HIGH Published 2020-07-29 Modified 2023-03-03 Official page ↗
Aliases
CVE-2020-7685
Ecosystem
NuGet
Packages
UmbracoForms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1188
Reviewed
2020-07-29

Affected packages

• NuGet UmbracoForms: <= 8.4.1 (no fix yet)

Description

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.

Related

Alias · CVE (1)

  • CVE-2020-7685 This affects all versions of package UmbracoForms. vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References