Vulnerability · Published Jan 28, 2020 · Assigned by mitre

CVE-2020-7799

High 7.2

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 19.8% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)7.2High

Exploit odds (30 days)19.8%top 2.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://fusionauth.io/docs/v1/tech/release-notes x_refsource_MISC
20200127 CVE - CVE-2020-7799 - FusionAuth command execution via Apache Freemarker Template mailing-list, x_refsource_BUGTRAQ
http://packetstormsecurity.com/files/156102/FusionAuth-1.10-Remote-Command-Execution.html x_refsource_MISC
https://lab.mediaservice.net/advisory/2020-03-fusionauth.txt x_refsource_MISC