Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-37080— webTareas 2.0.p8 - Arbitrary File Deletion

Quick assessment

Affected
luiswang webTareas
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

webTareas是luiswang个人开发者的一款基于Web的开源协作工具。该产品支持项目管理、错误跟踪、内容管理和会议管理等功能。 webTareas 2.0.p8版本存在安全漏洞，该漏洞源于print_layout.php管理组件中的atttmp1参数存在文件删除漏洞，可能导致删除服务器上的任意文件。

CVSS 9.8 · Critical EPSS 0.33% · P26

Possible ATT&CK Techniques 1 AI

T1485 · Data Destruction
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-37080

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
webTareas 2.0.p8 - Arbitrary File Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitrary files. Attackers can exploit the vulnerability by manipulating the 'atttmp1' parameter to specify and delete files on the server through an unauthenticated file deletion mechanism.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
webTareas 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
webTareas是luiswang个人开发者的一款基于Web的开源协作工具。该产品支持项目管理、错误跟踪、内容管理和会议管理等功能。 webTareas 2.0.p8版本存在安全漏洞，该漏洞源于print_layout.php管理组件中的atttmp1参数存在文件删除漏洞，可能导致删除服务器上的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
luiswang webTareas 2.0.p8 -

II. Public POCs for CVE-2020-37080

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-37080

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: webTareas
Same vendor: luiswang
Same weakness: CWE-73

V. Comments for CVE-2020-37080

No comments yet

Leave a comment