GitHub Advisoryadvisory · NuGet

GHSA-936x-wgqv-hhgq Authenticated path traversal in Umbraco CMS

MEDIUM Published 2021-04-13 Modified 2021-04-06 Official page ↗
Aliases
CVE-2020-5811
Ecosystem
NuGet
Packages
UmbracoCms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2021-04-06

Affected packages

• NuGet UmbracoCms: < 8.9.2 → fixed in 8.9.2

Description

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.

Related

Alias · CVE (1)

  • CVE-2020-5811 An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References