PT-2021-10218

CVE-2020-18704

Published

2021-08-16

Updated

2021-08-30

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Django-Widgy version 0.8.4

Description: The issue allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'. This is due to an unrestricted upload of files with dangerous types.

Recommendations: For Django-Widgy version 0.8.4, consider disabling the 'image' widget in the 'Change Widgy Page' component until a patch is available to prevent remote attackers from executing arbitrary code. Restrict access to file uploads to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Hatboy

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers

CVE-2020-18704