LiveActive security incident?Get immediate response
CVE Record

CVE-2020-13978: Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on t...

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-13978 describes a Monstra CMS 3.0.4 situation where someone who already has administrator access can use theme chunk editing to run operating-system commands. This is serious if an admin account is stolen, but the source also notes this may reflect intended administrator capability rather than a clear security boundary failure.

Executive priority

Treat this as a credential-governance and CMS hardening issue, not a confirmed unauthenticated emergency. Prioritize it if Monstra CMS 3.0.4 is internet-facing, has many administrators, or lacks strong admin access controls.

Technical view

The CVE states that Monstra CMS 3.0.4 administrators able to modify .chunk.php files through the Theme Module Edit Chunk screen can execute arbitrary OS commands. The record provides no CVSS score, CWE, named patch, or evidence of exploitation. The CVE note says there is no indication the feature intended to block administrator use of PHP exec functionality.

Likely exposure

Exposure appears limited to Monstra CMS 3.0.4 instances where untrusted or compromised administrator accounts can access theme chunk editing. Public unauthenticated exposure is not supported by the provided sources.

Exploitation context

The provided bundle does not show active exploitation, and the CVE is not listed as KEV. The key prerequisite is existing administrative access, so the practical risk centers on admin account compromise, excessive administrator delegation, or shared CMS admin credentials.

Researcher notes

The source evidence is narrow and includes an important caveat: administrators may have been expected to use PHP capabilities in chunk files. Avoid overstating this as a privilege-escalation flaw without additional vendor or maintainer confirmation.

Mitigation direction

  • Check Monstra project guidance and issue 464 for any vendor-recommended fix or clarification.
  • Restrict CMS administrator access to trusted users only.
  • Limit admin panel access with network controls where operationally feasible.
  • Disable or tightly govern theme/chunk editing if the business does not require it.
  • Monitor changes to theme chunk files and investigate unexpected edits.
  • Review host permissions for the web server process.

Validation and detection

  • Inventory whether Monstra CMS 3.0.4 is deployed.
  • Confirm who has CMS administrator privileges.
  • Verify Theme Module Edit Chunk access is limited to trusted administrators.
  • Review recent chunk or theme file changes for unexpected modifications.
  • Check server and CMS logs for suspicious administrator activity.
  • Track the CVE record and linked GitHub issue for updates.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-13978 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.