High severity · published Nov 16, 2020
CVE-2020-27191
LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion
7.5
CVSS
9.6%
EPSS
No
On KEV
Description
LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lionwiki · Lionwiki
before 3.2.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27191
Vendor Advisory
http://lionwiki.0o.cz/index.php?page=Main+page
Exploit
https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi
More from Lionwiki
–
CVE-2009-3534
Directory traversal vulnerability in index.php in LionWiki 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a