Vulnerabilities > CVE-2020-19155 - Exposure of Resource to Wrong Sphere vulnerability in Jflyfox Jfinal CMS

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

jflyfox

CWE-668

NVD

Published: 2021-09-15

Updated: 2022-10-26

Summary

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.

Vulnerable Configurations

Part	Description	Count
Application	Jflyfox Jflyfox Jfinal CMS - Jflyfox Jfinal CMS 1.1 Jflyfox Jfinal CMS 1.2 Jflyfox Jfinal CMS 1.3 Jflyfox Jfinal CMS 1.4 Jflyfox Jfinal CMS 1.4.1 Jflyfox Jfinal CMS 1.4.2 Jflyfox Jfinal CMS 2.0.0 Jflyfox Jfinal CMS 2.1.0 Jflyfox Jfinal CMS 2.1.1 Jflyfox Jfinal CMS 2.3.0 Jflyfox Jfinal CMS 2.4.0 Jflyfox Jfinal CMS 2.5.0 Jflyfox Jfinal CMS 2.6.0 Jflyfox Jfinal CMS 2.7.0 Jflyfox Jfinal CMS 2.8.0 Jflyfox Jfinal CMS 2.9.0 Jflyfox Jfinal CMS 2.9.1 Jflyfox Jfinal CMS 2.9.2 Jflyfox Jfinal CMS 3.0.0 Jflyfox Jfinal CMS 3.1.0 Jflyfox Jfinal CMS 3.1.1 Jflyfox Jfinal CMS 4.0.0 Jflyfox Jfinal CMS 4.1.0 Jflyfox Jfinal CMS 4.1.1 Jflyfox Jfinal CMS 4.1.2 Jflyfox Jfinal CMS 4.1.3 Jflyfox Jfinal CMS 4.1.4 Jflyfox Jfinal CMS 4.1.5 Jflyfox Jfinal CMS 4.2.0 Jflyfox Jfinal CMS 4.3.0 Jflyfox Jfinal CMS 4.4.0 Jflyfox Jfinal CMS 4.5.0 Jflyfox Jfinal CMS 4.6.0 Jflyfox Jfinal CMS 4.7.0 Jflyfox Jfinal CMS 4.7.1	36

Common Weakness Enumeration (CWE)

CWE-668 - Exposure of Resource to Wrong Sphere

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References