CERT-In Vulnerability Note
CIVN-2020-0442
Multiple vulnerabilities in Contact Form 7
Original Issue Date:December 21, 2020
Severity Rating: HIGH
Software Affected
- Contact Form 7 5.3.1 and older versions
Overview
A vulnerability has been discovered in Contact Form 7 version 5.3.1 or older that allows an attacker to upload malicious scripts.
Description
An unrestricted file upload vulnerability is found in a Word Press plug-in. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation. It allows an unauthenticated user to bypass any form file-type restrictions in Contact Form 7 and upload an executable binary to a site running the plug-in version 5.3.1 or earlier.
Successful exploitation of this vulnerability could allow the attacker to bypass any form file-type restrictions in Contact Form 7.
Solution
Update to Contact Form 7 5.3.2
https://contactform7.com/2020/12/
Vendor Information
Word Press
https://wordpress.org/plugins/contact-form-7/
References
Acunetix
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-contact-form-7-arbitrary-file-upload-3-5-2/
Searchenginejournal
https://www.searchenginejournal.com/contact-form-7-vulnerability-in-5-million-sites/391111/
Threatpost
https://threatpost.com/contact-form-7-plugin-bug/162383/
Security newspaper
https://www.securitynewspaper.com/2020/03/03/contact-form-7-over-5-million-wordpress-sites-affected-by-critical-vulnerability/
Tenable
https://www.tenable.com/cve/CVE-2020-35489
CVE Name
CVE-2020-35489
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|