CVE-2020-5194
published 2020-01-14CVE-2020-5194: The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.68%
47.6th percentile
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cerberusftp | ftp_server | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcementshttps://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilitieshttps://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcementshttps://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities
2020-01-14
Published