CVE-2016-20023 In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.
MediumCVSS 6.5
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CKSource ckfinder | >= 2, < 2.5.0.1 | 2.5.0.1 |
| CKSource ckfinder | < 2.5.0.1 | 2.5.0.1 |
References
- download.cksource.com product
- ckeditor.com release-notes