Description

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an PHP code injection attack by passing specially formed parameters to URL that may possibly leading to remote code execution (RCE).

Remediation

Upgrade to the latest version of nette/application and/or nette/nette.

References

Potential Remote Code Execution vulnerability

Related Vulnerabilities

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2020-11057)

Apache Log4j2 JNDI Remote Code Execution (delayed)

WordPress Plugin Kanzu Support Desk-WordPress Helpdesk Remote Code Execution (2.4.6)

CakePHP 1.3.5 / 1.2.8 unserialize() vulnerability

WordPress Plugin WP ALL Export Pro Multiple Vulnerabilities (1.7.8)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution CWE-94 CVE-2020-15227