In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html | Third Party Advisory |
https://www.coresecurity.com/advisories | Third Party Advisory |
https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-06-05T13:00:25
Updated: 2020-06-09T21:06:26
Reserved: 2020-05-14T00:00:00
Link: CVE-2020-12848
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-06-05T13:15:10.617
Modified: 2021-07-21T11:39:23.747
Link: CVE-2020-12848
JSON object: View
Redhat Information
No data.
CWE