CVE-2020-28672 - MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution

Back Back to CVE browser

HIGH

MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution

Published Jan 7, 2021

7.2

HIGH

CVSS 3.1

EPSS 12.14%

Description

MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles/category.php:27, user input can be saved to category/[foldername]/index.php causing RCE.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21070
Advisory
https://github.com/fortest-1/vuln/blob/main/MonoCMS%20Blog/MonoCMS%20Blog%201.0_remote_code_execution.md
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21070		Advisory
https://github.com/fortest-1/vuln/blob/main/MonoCMS%20Blog/MonoCMS%20Blog%201.0_remote_code_execution.md		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 7, 2021

Updated Aug 4, 2024

Reserved Nov 16, 2020

Link CVE-2020-28672

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-28672

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jan 7, 2021

Updated Aug 4, 2024

Link EUVD-2020-21070

GitHub

No data