CVE-2020-28187

Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

16.35% chance of exploitation in the next 30 days, 97th percentile

Nuclei

critical

Published

2020-12-24

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/CVE-2020-28187.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-28187.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-28186
• CVE-2020-28188
• CVE-2020-28185
• CVE-2020-28190
• CVE-2020-28184
• CVE-2020-28198