CVE-2020-28165: Malicious File Upload
Published Aug 12, 2021
·Updated
The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.
Affected Software
1 affected component
EasyCorp ZenTao<12.4.2
Event History
Aug 12, 2021
CVE Published
via MITRE·11:01 AM
Data Sourced
via MITRE·11:01 AM
Description
Frequently Asked Questions
1
What is CVE-2020-28165?
CVE-2020-28165 is an arbitrary file upload vulnerability in the EasyCorp ZenTao PMS 12.4.2 application.
2
What is the severity of CVE-2020-28165?
CVE-2020-28165 has a severity rating of 9.8, which is considered critical.
3
How can an attacker exploit CVE-2020-28165?
An attacker can exploit CVE-2020-28165 by uploading an arbitrary webshell to the server using the downloadZipPackage() function.
4
Which version of EasyCorp ZenTao is affected by CVE-2020-28165?
EasyCorp ZenTao version 12.4.2 is affected by CVE-2020-28165.
5
Is there a fix for CVE-2020-28165?
At the moment, there is no known fix for CVE-2020-28165. It is recommended to update to a newer version or apply any patches provided by the vendor.