CVE-2020-13383

CVE-2020-13383

EPSS 69.6%

Vexday Risk Score

30Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 69.6%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

30 Jun 2020Metasploit module available

01 Jul 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

openSIS through 7.4 allows Directory Traversal.

Affected products

References

http://packetstormsecurity.com/files/158256/openSIS-7.4-Local-File-Inclusion.html http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8