CVE-2020-9354

PoC —

CVSS 3.1

7.5 high

EPSS

1%p66

Published

Feb 23, 2020 (Feb 23, 2020)

Modified

Jun 17, 2026

Description

An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. path traversal.

Vendors: smartclient
Products: smartclient
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.