CVE-2020-5196: High severity Cerberusftp Ftp Server vulnerability
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cerberus FTP Server Enterprise Editionto a version that resolves this vulnerability.Fixed in 11.0.3 - Upgrade
Upgrade
Cerberus FTP Server Enterprise Editionto a version that resolves this vulnerability.Fixed in 10.0.18
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cerberus FTP Server Enterprise Edition vulnerability?
The vulnerability ID for this Cerberus FTP Server Enterprise Edition vulnerability is CVE-2020-5196.
What is the severity rating of CVE-2020-5196?
The severity rating of CVE-2020-5196 is 8.1 (high).
Which versions of Cerberus FTP Server Enterprise Edition are affected by CVE-2020-5196?
Cerberus FTP Server Enterprise Edition versions prior to 11.0.3 and 10.0.18 are affected by CVE-2020-5196.
What are the potential consequences of CVE-2020-5196?
An authenticated attacker can create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files.
How can I fix CVE-2020-5196 vulnerability in Cerberus FTP Server Enterprise Edition?
To fix CVE-2020-5196 vulnerability, you need to update Cerberus FTP Server Enterprise Edition to version 11.0.3 or 10.0.18.