Security readout for executives and security teams
Plain-English summary
CVE-2020-36825 concerns an unsupported cyberaz0r WebRAT project where a file-handling API may allow unrestricted upload through the download_file function. The record is disputed, and the maintainer reportedly doubts CVE eligibility. Treat it as a cleanup and verification issue unless WebRAT is actually present.
Executive priority
Prioritize only if WebRAT exists in your environment. Unsupported remote administration tools can create outsized operational risk, but this CVE has disputed evidence and no cited active exploitation. The main business action is inventory, removal, and compensating access control.
Technical view
Sources describe CWE-434 in WebRAT Server/api.php, affecting download_file and the name argument, with network attack vector and authenticated access in CVSS v2. The affected version is listed as 20191222 or earlier. The patch hash is named, but the GitHub link is broken and the repository is now private.
Likely exposure
Exposure is likely limited to environments still running the unsupported cyberaz0r WebRAT project, especially version 20191222 or older. The project appears low-usage and unsupported, so broad enterprise exposure is unlikely unless it was installed experimentally or inherited.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. VulDB labels the issue critical, but the CVE bundle marks it medium and disputed. The CVSS vector indicates remote exploitation requiring authentication, but the vulnerability’s real existence is explicitly questioned.
Researcher notes
Do not assume exploitability beyond the record. Key gaps are the private repository, broken patch link, disputed status, and lack of KEV evidence. Validation should focus on product presence, code provenance, patch verification, and whether authenticated file-handling behavior exists.
Mitigation direction
- Remove unsupported WebRAT deployments from production where possible.
- Apply the referenced patch only if its authenticity can be verified.
- Restrict WebRAT access to trusted administrators and networks.
- Review vendor or maintainer guidance before relying on the broken patch link.
- Monitor for unexpected uploaded files or changes under WebRAT paths.
Validation and detection
- Inventory systems for cyberaz0r WebRAT and version 20191222 or older.
- Check whether Server/api.php and download_file functionality are present.
- Confirm whether patch 0c394a795b9c10c07085361e6fcea286ee793701 is applied from trusted history.
- Review access logs for unusual authenticated api.php file-handling activity.
- Document uncertainty because the CVE is disputed and source evidence is limited.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36825 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-257782 | cyberaz0r WebRAT api.php download_file unrestricted uploadCVE reference · vdb-entry, technical-description
- VDB-257782 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- https://github.com/cyberaz0r/WebRAT/commit/0c394a795b9c10c07085361e6fcea286ee793701CVE reference · broken-link, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.