CVE-2020-20601

CRITICAL WAF: Medium
CVSS 9.8 Published: 2021-12-22
CWE-94

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.

WAF Coverage Analysis

Code Injection Medium WAF Coverage

OWASP: A03:2021 Injection

932xxx - Remote Code Execution 933xxx - PHP Injection 934xxx - Node.js / Generic Injection

Affected Software

VendorProductVersion
thinkcmfthinkcmfx1.6.0
thinkcmfthinkcmfx2.1.0
thinkcmfthinkcmfx2.2.0
thinkcmfthinkcmfx2.2.1
thinkcmfthinkcmfx2.2.2

References

Back to CVE Database