CVE-2020-27575
HighCVSS 8.8Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
Maxum Rumpus 8.2.13 and 8.2.14 are affected by a command injection vulnerability. The user management functionality in the web administration panel contains a parameter that, due to insufficient validation, allows execution of arbitrary system commands.
Risk Assessment
An attacker with administrative privileges can exploit this vulnerability to execute arbitrary commands on the server, leading to full system compromise and potential takeover of the application.
Recommendation
Immediately update Maxum Rumpus to a version later than 8.2.14 that includes a fix for the command injection vulnerability.
Other vulnerabilities in Maxum Rumpus
See all- CVE-2020-27576Medium
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
- CVE-2020-27574High
A CSRF vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows an attacker to perform unintended actions in the web application if an authenticated user visits a malicious page.
Original NVD description (English source)
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.