CVE-2020-26286 : HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeD

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage.

Published 2020-12-29 00:15:13

Updated 2020-12-30 16:14:55

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-26286

Hedgedoc » Hedgedoc
Versions before (<) 1.7.1
cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-26286

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-26286

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2020-26286

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2020-26286

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc

Arbitrary file upload · Advisory · hedgedoc/hedgedoc · GitHub
Third Party Advisory
https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1

Release HedgeDoc 1.7.1 · hedgedoc/hedgedoc · GitHub
Third Party Advisory

CVEs referencing this url
https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8

Merge pull request from GHSA-wcr3-xhv7-8gxc · hedgedoc/hedgedoc@e930699 · GitHub
Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2020-26286

Products affected by CVE-2020-26286

Exploit prediction scoring system (EPSS) score for CVE-2020-26286

CVSS scores for CVE-2020-26286

CWE ids for CVE-2020-26286

References for CVE-2020-26286