CVE-2020-12849

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-12849
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12849.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-12849
Published
2020-06-05T13:15:10.790Z
Modified
2026-03-14T10:00:06.116868Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.

References

Affected packages

Git / github.com/pydio/cells

Affected ranges

Type
GIT
Repo
https://github.com/pydio/cells
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
07dc2557e3a7099e8bb3b6c7b0dcb4ac80d31601
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.4"
        }
    ]
}

Affected versions

v0.*
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.4.0
v1.4.1
v1.5.0
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.1
v2.0.2
v2.0.2-dev.20191219
v2.0.3
v2.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12849.json"