Vulnerability · Published Jul 15, 2020 · Assigned by mitre
CVE-2020-12854
High 8.8
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)3.0%top 12.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A remote code execution vulnerability was identified in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can invoke code execution upon uploading a carefully crafted JPEG file as part of the profile avatar.
Affected products (as reported)
References
- https://seczetta.com x_refsource_MISC
- http://packetstormsecurity.com/files/158434/SecZetta-NEProfile-3.3.11-Remote-Code-Execution.html x_refsource_MISC