CVE-2018-20062 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03
NoneCms V1.3, which utilizes ThinkPHP, contains a remote code execution vulnerability in thinkphp/library/think/App.php. Attackers can execute arbitrary PHP code by supplying a crafted filter parameter in a query string.
Quick answers
Is CVE-2018-20062 exploited in the wild?
Yes. CVE-2018-20062 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2018-20062?
Critical severity, with a CVSS score of 9.8, published 3 November 2021.
Which products and versions are affected?
5none noneCms 1.3.0; ThinkPHP ThinkPHP 5.0.23.
Is there a fix for CVE-2018-20062?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-20062 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2018-20062?
Check whether you run Thinkphp Nonecms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
5none noneCms 1.3.0
ThinkPHP ThinkPHP 5.0.23
Timeline
2018-12-11: disclosed: NVD Published Date
2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2021-11-03: exploited: Reported as exploited in the wild per CISA KEV entry