by Kastro
Paper/Archive/CVE-2020-6142

CVE-2020-6142

talos — A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3.

EPSS 9%CVSS 9.9
critical.is priorityof 100
49
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 95.4.954 × 2019.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
OS4EdOS4Ed openSIS 7.3–CNA

Scores by source

talos (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1082