by Kastro
Paper/Archive/CVE-2020-36877

CVE-2020-36877

ReQuest Serious Play LLC ReQuest Serious Play Pro — ReQuest Serious Play F3 Media Server <= 7.0.3 code execution

EPSS 0.7%public exploitCVSS 9.3
critical.is priorityof 100
49
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 53.9.539 × 2010.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.

Affected

ProductAffectedFixed inSource
ReQuest Serious Play Pro7.0.3.4968–CNA
ReQuest Serious Play7.0.2.4954–CNA
ReQuest Serious Play6.5.2.4954–CNA
ReQuest Serious Play6.4.2.4681–CNA
ReQuest Serious Play6.3.2.4203–CNA
ReQuest Serious Play2.0.1.823–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/48952advisoryzeroscience.mk/en/vulnerabilities/ZSL-2020-5602.phprefrequest.comwriteupvulncheck.com/advisories/request-serious-play-f-media-server-unauthenticated-rce