CVE-2020-9280

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-9280

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9280.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-9280

Aliases

Published

2020-04-15T21:15:36Z

Modified

2026-08-07T15:14:57Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x.

References

Affected packages

Git

github.com/silverstripe/silverstripe-cms

Affected ranges

Type

GIT

Repo

https://github.com/silverstripe/silverstripe-cms

Events

Introduced

0c02b8872f29a1c789d3313562cde6117892d9c7

Last Affected

251ebb658c2e93b54d26f53ef2e0a8a7795947bc

Database specific

Show details

{
    "cpe": "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.5.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9280.json"

github.com/silverstripe/silverstripe-framework