CVE-2020-10560

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-03-30 · updated 2026-06-17
Weakness: CWE-338

Description

An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.

Affected products

opensource-socialnetwork Open Source Social Network: through 5.3

References

https://github.com/LucidUnicorn/CVE-2020-10560-Key-Recovery
https://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read
https://github.com/LucidUnicorn/CVE-2020-10560-Key-Recovery
https://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read

Get alerted when CVE-2020-10560 or the next vulnerability affects your stack