CVE-2020-13227

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/wrongsid3Third Party Advisory
https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.mdExploit, Third Party Advisory
https://pasteboard.co/J9eF12G.pngExploit, Third Party Advisory
https://github.com/wrongsid3Third Party Advisory
https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.mdExploit, Third Party Advisory
https://pasteboard.co/J9eF12G.pngExploit, Third Party Advisory

Timeline

Published: Jun 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-132286.1An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.CVE-2020-132298.8An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is CVE-2020-13236.1An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could se CVE-2020-132304.3In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission t CVE-2020-132316.5In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.CVE-2020-132387.5Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted pac CVE-2020-132395.4The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the dir CVE-2020-13247.8An elevation of privilege (user to user) vulnerability exists in Windows Security Health Service when handling certain objects in memory.To CVE-2020-132405.4The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecu CVE-2020-132417.8Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file ext CVE-2020-132455.9Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, an CVE-2020-132467.5An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership fro