CVE-2020-11467

CVE-2020-11467 is a remote code execution vulnerability affecting Deskpro versions prior to 2019.8.0. It allows authenticated administrators to exploit a weakness in the theme template editing function, specifically through the TWIG template engine, to trigger an insecure deserialization. This enables an attacker to pass a crafted payload to a native unserialize function, leading to remote code execution. With a CVSS score of 7.2 (HIGH), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.