CVE-2020-25466

2020-10-2315:15:12

Google

osv.dev

ssrf

crmeb 3.0

download image

remote file download

code execution

AI Score

7.5

Confidence

High

EPSS

0.017

Percentile

87.8%

JSON

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.

References

crmeb.com

github.com/crmeb/CRMEB

github.com/crmeb/CRMEB/issues/22