CVE-2020-5194: Medium severity Cerberusftp Ftp Server vulnerability

Published Jan 14, 2020

Updated

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajaxdownloadzip/zipname endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.

Affected Software

1 affected component

Cerberusftp Ftp Server=8.0

Event History

Jan 14, 2020

CVE Published

via MITRE·01:34 PM

Data Sourced

via MITRE·01:34 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-5194?

CVE-2020-5194 is a vulnerability in Cerberus FTP Server 8 that allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint.

How does CVE-2020-5194 affect Cerberus FTP Server 8?

CVE-2020-5194 affects Cerberus FTP Server 8 by allowing an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint.

What is the severity of CVE-2020-5194?

The severity of CVE-2020-5194 is medium with a CVSSv3 score of 5.4.

How can I fix CVE-2020-5194?

To fix CVE-2020-5194, update Cerberus FTP Server 8 to a version that includes the necessary patches and fixes for the vulnerability.

Where can I find more information about CVE-2020-5194?

You can find more information about CVE-2020-5194 in the Cerberus FTP Server support community topics and the doyler.net security blog.