CVE-2020-5194 - CVE House
Back to Database
Status published Medium CVE-2020-5194

The zip API endpoint in Cerberus FTP Server 8 allows...

Vulnerability Description

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5194

Credits & Attribution

No credits recorded in the NVD database.

References

More from cerberusftp

View All →
CVE-2020-5196
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and...
High 8.1
CVE-2020-5195
Reflected XSS through an IMG element in Cerberus FTP Server...
Medium 6.1
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19...
Medium 6.1
CVE-2017-6367
In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes...
High 7.5
CVE-2012-6339
Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface...
Medium 4.3

Affected Vendor

cerberusftp

View all reports →

Affected Software

ftp server
Vulnerable Versions:
8.0

Timeline

Official Publish: January 14th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.