CVE-2020-8986 - CVE House

Status published Critical CVE-2020-8986

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly...

9.8 CVSS

Vulnerability Description

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-8986

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://zend.to/changelog.php

More from zend

View All →

CVE-2021-27888

ZendTo before 6.06-4 Beta allows XSS during the display of...

Medium 6.1

CVE-2020-8985

ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF...

High 8.8

CVE-2020-8984

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address...

High 7.5

CVE-2020-29312

An issue found in Zend Framework v.3.1.3 and before allow...

Critical 9.8

CVE-2018-10230

Zend Debugger in Zend Server before 9.1.3 has XSS, aka...

Medium 6.1

Affected Vendor

zend

View all reports →

Affected Software

zendto

Vulnerable Versions:

3.10, 3.11, 3.12, 3.13, 3.20, 3.51, 3.52, 3.53, 3.54, 3.55, 3.56-2, 3.57, 3.58, 3.59, 3.60, 3.61, 3.62, 3.63, 3.64, 3.65, 3.70-2, 3.71, 3.72, 3.73, 3.74, 3.75, 3.90, 3.91, 3.92, 3.93, 3.94, 4.00, 4.01, 4.02, 4.03-3, 4.05-2, 4.06-2, 4.07-1, 4.08-4, 4.09-1, 4.10-4, 4.10-5, 4.11-1, 4.11-2, 4.11-3, 4.11-4, 4.11-5, 4.11-7, 4.11-8, 4.11-9, 4.11-10, 4.11-11, 4.11-12, 4.11-13, 4.11-14, 4.12-5, 4.12-6, 4.13-1, 4.20-2, 4.20-3, 4.20-5, 4.20-6, 4.20-7, 4.25-3, 4.27-1, 4.27-2, 4.27-4, 4.27-5, 4.27-6, 4.27-7, 4.28-1, 4.28-2, 5.00-1, 5.00-2, 5.01-5, 5.02-5, 5.03-1, 5.04-7, 5.09-13, 5.10-1, 5.10-2, 5.11-1, 5.11-2, 5.11-3, 5.11-4, 5.11-5, 5.11-6, 5.12-3, 5.12-4, 5.12-6, 5.12-7, 5.12-8, 5.13-1, 5.13-2, 5.14-2, 5.14-5, 5.15-1, 5.16-1, 5.16-4, 5.16-5, 5.16-7, 5.16-8, 5.16.6, 5.17-1, 5.17-2, 5.17-3, 5.17-4, 5.17-5, 5.17-6, 5.18-1, 5.18-2, 5.19-1, 5.20-1, 5.20-2, 5.20-3, 5.20-5, 5.20-6, 5.20-7, 5.20-8, 5.20-9, 5.21-1, 5.21-2, 5.22-1

Timeline

Official Publish: March 24th, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.