A vulnerability was found in Pydio Core and Enterprise up to 8.2.3 and classified as critical. This issue affects some unknown processing of the file plugins/core.access/src/RecycleBinManager.php. The manipulation as part of a Object leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.

The weakness was published 03/17/2020. The identification of this vulnerability is CVE-2019-20452 since 02/12/2020. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

By approaching the search of inurl:plugins/core.access/src/RecycleBinManager.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.2.4 eliminates this vulnerability.

Similar entry is available at VDB-151746.

Productinfo

Vendor

• Pydio

Name

• Core
• Enterprise

Version

• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion