LiveActive security incident?Get immediate response
CVE Record

CVE-2020-20907: MetInfo 7.0 beta is affected by a file modification vulnerability.

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

MetInfo 7.0 beta is reported to allow attackers to delete or modify INI files through specific application code paths. The business concern is unauthorized configuration or language-file changes, which could disrupt site behavior or weaken integrity. Public source data does not provide severity scoring, prerequisites, affected non-beta versions, or a confirmed fix.

Executive priority

Prioritize this as an inventory and hygiene issue unless MetInfo 7.0 beta is exposed in production. If found on a public or business-critical site, move quickly to vendor guidance, backups, monitoring, and upgrade planning.

Technical view

The CVE describes a file modification vulnerability in MetInfo 7.0 beta involving app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php. References include CWE-23, but the CVE record does not assign a CWE. Attack preconditions, authentication requirements, impact scope, and remediation details are not established in the provided sources.

Likely exposure

Exposure is limited by the available evidence to organizations running MetInfo 7.0 beta. The sources do not identify affected stable releases, deployment configurations, internet-facing requirements, or whether authentication is needed.

Exploitation context

CISA KEV status is false, and the provided bundle contains no cited evidence of active exploitation. Public details are sparse and should not be treated as proof of either exploit availability or exploit absence.

Researcher notes

The record is thin: no CVSS, no assigned CWE, no CPEs, and no named patch. The CWE-23 reference suggests path traversal may be relevant, but that should be validated against the GitHub reports and source code rather than assumed.

Mitigation direction

  • Inventory systems for MetInfo 7.0 beta deployments.
  • Check MetInfo or maintainer guidance for fixed versions or official mitigations.
  • Migrate away from beta software where production exposure exists.
  • Restrict access to MetInfo administrative surfaces while remediation is assessed.
  • Back up and monitor INI files for unauthorized changes.

Validation and detection

  • Confirm installed MetInfo version on each relevant web property.
  • Review whether the named source files exist in deployed code.
  • Check INI files for unexpected modifications or deletions.
  • Review application and server logs for suspicious file-change activity.
  • Document unknowns: authentication requirement, affected versions, and vendor fix status.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-20907 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.