CVE-2020-12687

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-07 · updated 2026-06-17
Weakness: CWE-668

Description

An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users (including administrators) from the database.

Affected products

Serpico Project Serpico: before 1.3.3 — fixed in 1.3.3

How to fix

Upgrade to a fixed version: Serpico Project Serpico 1.3.3. Check the vendor advisory for mitigations.

References

https://github.com/SerpicoProject/Serpico/commit/0b8600414976a5ad733604c7b1428071baf239c2
https://github.com/SerpicoProject/Serpico/releases/tag/1.3.3
https://github.com/SerpicoProject/Serpico/commit/0b8600414976a5ad733604c7b1428071baf239c2
https://github.com/SerpicoProject/Serpico/releases/tag/1.3.3

Get alerted when CVE-2020-12687 or the next vulnerability affects your stack