CVE-2020-15189 - CVE House
Back to Database
Status published Medium CVE-2020-15189

Remote Code Execution in SOY CMS

Vulnerability Description

SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15189

Credits & Attribution

No credits recorded in the NVD database.

References

More from inunosinsi

View All →
CVE-2024-28187
OS Command Injection Vulnerability in SOY CMS
High 7.2
CVE-2020-15188
Unauthenticated Remote Code Execution in SOY CMS
Critical 10
CVE-2020-15183
Reflected XSS leading to RCE in SoyCMS
High 8.4
CVE-2020-15182
Cross-site Request Forgery leading to RCE in SOY CMS
High 8.4

Affected Vendor

Affected Software

soycms
Vulnerable Versions:
< 3.0.2.328

Timeline

Official Publish: September 18th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact