CVE-2020-15189

SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.

SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.

SOY CMS versiones 3.0.2 y anteriores, están afectadas por una Ejecución de Código Remota (RCE) usando una Carga de Archivos Sin Restricciones. La vulnerabilidad de tipo Cross-Site Scripting (XSS) que fue usada en el CVE-2020-15183 puede ser usada para aumentar el impacto al redireccionar el administrador para que acceda a una página especialmente diseñada. Esta vulnerabilidad es causada por una configuración no segura en elFinder. Esto es corregido en la versión 3.0.2.328