CVE-2020-24985

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads.

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 NVD

5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

1.10% chance of exploitation in the next 30 days, 65th percentile

Published

2021-03-15

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://c41nc.co.uk/cve-2020-24985/

Security advisories

• https://c41nc.co.uk/cve-2020-24985

References

• CVE Record
• NVD entry