CVE-2020-5196
High
Description
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCerberusftp Ftp Server
PublishedJan 14, 2020
First seenJan 14, 2020
How to fix
Update
- cerberusftp ftp_server10.0.18, 11.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cerberusftp ftp_server | 10.0.0 ≤ v < 10.0.18, 11.0.0 ≤ v < 11.0.3 | 10.0.18, 11.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.