CVE-2020-5196 - CVE House
Back to Database
Status published High CVE-2020-5196

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and...

Vulnerability Description

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5196

Credits & Attribution

No credits recorded in the NVD database.

References

More from cerberusftp

View All →
CVE-2020-5195
Reflected XSS through an IMG element in Cerberus FTP Server...
Medium 6.1
CVE-2020-5194
The zip API endpoint in Cerberus FTP Server 8 allows...
Medium 5.4
CVE-2019-25046
The Web Client in Cerberus FTP Server Enterprise before 10.0.19...
Medium 6.1
CVE-2017-6367
In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes...
High 7.5
CVE-2012-6339
Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface...
Medium 4.3

Affected Vendor

cerberusftp

View all reports →

Affected Software

ftp server
Vulnerable Versions:
10.0.0, 11.0.0

Timeline

Official Publish: January 14th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.