CVE-2020-27304
highpriority · track · 40EPSS 0.032 · 88 %ileDEEURUUSEPSS · scored 2026-10-27
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSCALANCE LPE9403siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811123/ - FixedSINEC INSsiemens_psirt
Update to V1.0.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - FixedSINEC INScisa_csaf_ot
Update to V1.0.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - FixedSCALANCE LPE9403cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811123/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
- siemens sinec infrastructure network services< 1.0.1.1nvdUScpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
advisories (4)
Vendor and ecosystem advisories describing this.
- SSA-222547SSA-222547: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.02022-06-14csaf · siemens_psirtDE
Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability. Siemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.
- SSA-389290SSA-389290: Third-Party Component Vulnerabilities in SINEC INS2022-03-08csaf · siemens_psirtDE
71 vulnerabilities in third-party components as Node.js, cURL, SQLite, CivetWeb and DNS(ISC BIND) could allow an attacker to interfere with the affected product in various ways. Siemens has released an update for SINEC INS and recommends to update to the latest versions.
- ICSA-22-069-09Siemens SINEC INS2022-03-08icsa · cisa_csaf_otUS
71 vulnerabilities in third-party components as Node.js, cURL, SQLite, CivetWeb and DNS(ISC BIND) could allow an attacker to interfere with the affected product in various ways. Siemens has released an update for SINEC INS and recommends to update to the latest versions.
- ICSA-22-167-09Siemens SCALANCE LPE9403 Third-Party Vulnerabilities2022-06-14icsa · cisa_csaf_otUS
Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability. Siemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfcnnvd
- https://groups.google.com/g/civetweb/c/yPBxNXdGgJQcnnvd
- https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-27304cnnvd
- https://packetstormsecurity.com/files/165129/Red-Hat-Security-Advisory-2021-4902-06.htmlcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-167-09cnnvd
- https://vigilance.fr/vulnerability/CivetWeb-directory-traversal-via-mg-handle-form-request-36763cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan