« Volver al listado

CVE-2020-26804

Estado: ModificadaAlta (8.8)—

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sapplica — Sentrifugo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-26804",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-12T19:15:14.973",
  "references": [
    {
      "url": "https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Sentrifugo 3.2, users can share an announcement under \"Organization -> Announcements\" tab. Also, in this page, users can upload attachments with the shared announcements. This \"Upload Attachment\" functionality is suffered from \"Unrestricted File Upload\" vulnerability so attacker can upload malicious files using this functionality and control the server."
    },
    {
      "lang": "es",
      "value": "En Sentrifugo versión 3.2, los usuarios pueden compartir un anuncio en la pestaña \"Organization -> Announcements\". Además, en esta página, los usuarios pueden cargar archivos adjuntos con los anuncios compartidos. Esta funcionalidad \"Upload Attachment\" está afectada por la vulnerabilidad de \"Unrestricted File Upload\", por lo que el atacante puede cargar archivos maliciosos utilizando esta funcionalidad y controlar el servidor"
    }
  ],
  "lastModified": "2026-06-17T03:08:21.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sapplica:sentrifugo:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A58D689D-23A7-4757-ACF6-203013E83667"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}