CVE-2020-9320 — Unrestricted File Upload in Anti-malware SDK

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.9%
top 24.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Avira Anti-malware SDKAvira Antivirus ServerAvira Antivirus FOR Endpoint+5 more
Timeline
PublishedFeb 20
Latest updateMay 24

Description

Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus for Small Business, Exchange Security (Gateway), Internet Security Suite for Windows, Prime, Free Security Suite for Windows, and Cross Platform Anti-malware SDK. NOTE: Vendor asserts that vulnerability does not exist in product

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages7 packages

▶NVDavira/avira_antivirus< 8.3.54.138
▶NVDavira/antivirus_server< 8.3.54.138

🔴Vulnerability Details

2
GHSA
GHSA-cw54-pxxw-878x: Avira AV Engine before 8↗2022-05-24
▶
CVEList
CVE-2020-9320: Avira AV Engine before 8↗2020-02-20
▶
CVE-2020-9320 — Unrestricted File Upload in Avira | cvebase