CVE-2020-24914

Severity

critical

Source

NVD · cve

Published

2021-03-04

CVSS

9.8

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-24914

⚡ RCE shame 50/100 rce

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

Players implicated

qcubed · vendor qcubed · product

Description

Sentiment · trusted sources

synthesis severe-fallout -0.80

Widely condemned due to unauthenticated RCE in all versions
cooey ↗ severe-fallout -0.90

Damning disclosure of unauthenticated RCE in all versions

“A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.”
www.cvefind.com ↗ severe-fallout -0.50

Neutral listing of vulnerability in database
app.opencve.io ↗ severe-fallout -0.50

Neutral listing of vulnerability in database
chromereleases.googleblog.com ↗ severe-fallout +0.00

Irrelevant content unrelated to qcubed
www.techradar.com ↗ severe-fallout +0.00

Irrelevant content unrelated to qcubed
www.pcworld.com ↗ severe-fallout +0.00

Irrelevant content unrelated to qcubed
classactionu.org ↗ severe-fallout +0.00

Irrelevant content unrelated to qcubed

Affected FedRAMP products 0 in the catalog

No correlated FedRAMP products.