CVE-2020-36882
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-10
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flexense | diskboss | 7.7.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files through the /Command/Search Files/Directory field. This can lead to a denial of service by crashing the application.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to crash the DiskBoss application, causing a denial of service. This disrupts normal operations and availability of the application.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the crash condition in DiskBoss 7.7.14 using the 'Search Files' command. Specifically, a test can be performed by pasting a large buffer (e.g., 7000 'A' characters) into the 'Add Input Directory' field under the 'Command' -> 'Search Files' menu. If the application crashes, the vulnerability is present. There are no specific network detection commands provided, as the exploit is local and requires user interaction within the application. [3, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to DiskBoss 7.7.14 to trusted users only, avoiding the use of the vulnerable 'Search Files' directory input feature with untrusted input, and monitoring for any abnormal application crashes. Since the vulnerability allows unauthenticated arbitrary file uploads leading to denial of service, applying any available patches or upgrading to a newer, fixed version of DiskBoss is recommended once available. Additionally, consider isolating the affected system to prevent exploitation. [4]