CVE-2020-23370

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.6

Description The issue allows remote attackers to upload a swf file, which can be injected with arbitrary web script or HTML, via the action parameter in the "common/static/plugin/ueditor/1.4.3.3/php/controller.php" API endpoint.

Recommendations For YzmCMS version 5.6, as a temporary workaround, consider restricting access to the action parameter in the "common/static/plugin/ueditor/1.4.3.3/php/controller.php" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.