CVE-2020-36037

EUVD-2020-23620
An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
wuzhicmswuzhicms
4.1.0
𝑥
= Vulnerable software versions
References
https://github.com/wuzhicms/wuzhicms/issues/192
https://github.com/wuzhicms/wuzhicms/issues/192