CVE-2020-4039

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40404.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins CVE-2020-40416.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code CVE-2020-40426.8Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret i CVE-2020-40439.8phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted CVE-2020-40447.8The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp CVE-2020-40457.5SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly CVE-2020-40465.4In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj CVE-2020-40476.8In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media CVE-2020-40485.7In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted CVE-2020-40492.4In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript CVE-2020-40503.1In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It CVE-2020-40515.4In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less tha