HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2020-5196

CVSS 8.1v3.1pub. 2020-01-14upd. 2024-11-21

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Cerberusftp Ftp Server

    APP
    Cerberusftp
    10.0.0 – 10.0.18 (bez)11.0.0 – 11.0.3 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-6265HIGH7.3ten sam produkt

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Esca...

CVE-2017-6367HIGH7.5ten sam produkt

In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack method...

CVE-2019-25046MEDIUM6.1ten sam produkt

The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG d...

CVE-2020-5194MEDIUM5.4ten sam produkt

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use t...

CVE-2020-5195MEDIUM6.1ten sam produkt

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remo...