CVE DatabaseCVE-2020-28948

Updated 2026-06-17한국어 권고문 →

CVE-2020-289487.8/HIGHCWE-502

CVE-2020-28948 Official NVD Security Advisory (CVSS 7.8)

⚡ Jump to Patch

Affected Vendors

security-advisory

Affected Components

software

Published Date

2020-11-19

CVSS v3.1

7.8

HIGH

EPSS (30d)

47.5%

FIRST.org

CISA KEV

Not Listed

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Scope

Impacted configurations listed under CVE-2020-28948

Overview

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked....

Mitigation

Review official patches and verify network isolation controls.

Affected Products & Version Scope

Refer to official NVD CPE configuration entries

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply the latest security updates provided by the official software maintainers.

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Audit runtime exposure and verify patching status via automated scanning.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

Official NVD Technical Description

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVSS Score: 7.8 (HIGH)
CWE IDs: CWE-502

Official Vendor Advisories & References

NVD Original English Description

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

https://github.com/pear/Archive_Tar/issues/33

Source: cve@mitre.org · Exploit, Issue Tracking, Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html

Source: cve@mitre.org · Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/

Source: cve@mitre.org

Frequently Asked SecOps Questions (CVE-2020-28948)

FAQ

Q1. How critical is CVE-2020-28948 and is it actively exploited in the wild?

CVE-2020-28948 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 47.5%. Organizations running affected versions should prioritize patching based on network exposure.

Q2. Which vendors and products are affected by CVE-2020-28948?

Primary impacted vendors include security-advisory across software. Scope summary: Refer to official NVD CPE configuration entries

Q3. What temporary mitigations or workarounds exist for CVE-2020-28948 before patching?

[Mitigation] Review official patches and verify network isolation controls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION