CVE-2020-14942: Unrestricted Deserialization in Tendenci 12.0.10
Summary
CVE-2020-14942: Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py. Affects tendenci versions < 12.0.11. Fixed in 12.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendenci is an open-source content management system (CMS) written in Python and based on the Django web framework. It is designed specifically for non-profit organizations and associations to manage their websites and online communities. Tendenci provides various features such as event management, membership management, and content publishing. However, Tendenci version 12.0.10 is vulnerable to unrestricted deserialization in the 'apps/helpdesk/views/staff.py' file.
Vulnerability Detail
The vulnerability in Tendenci 12.0.10 allows for unrestricted deserialization, which can lead to remote code execution attacks. An attacker can exploit this vulnerability by sending a specially crafted serialized object to the affected application, which will be deserialized without proper validation. This can result in the execution of arbitrary code with the privileges of the application, potentially leading to a complete compromise of the system.
How To Fix
Minimum fixed version
12.0.11
This is the first release that contains the fix.
pip install --upgrade "tendenci==12.0.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Tendenci.
Conclusion
Tendenci version 12.0.10 is vulnerable to unrestricted deserialization, which can lead to remote code execution attacks. It is crucial for users of Tendenci to upgrade to version 12.0.11 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tendenci →
FAQ
This vulnerability can allow an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the system.
All installations of Tendenci version 12.0.10 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability has been fixed in Tendenci version 12.0.11.
You can find more information about this vulnerability in the Tendenci advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/tendenci/PYSEC-2020-112.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for tendenci.
