CVE-2020-11705 - An issue was discovered in ProVide (formerly zFTPServer) through 13.1

Back Back to CVE browser

CRITICAL

An issue was discovered in ProVide (formerly zFTPServer) through 13.1

Published Apr 12, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 0.91%

Description

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. /ajax/ImportCertificate allows an attacker to load an arbitrary certificate in .pfx format or overwrite arbitrary files via the fileName parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4047
Advisory
https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20Admin%20Interface%20-%20Authenticated%20Arbitrary%20File%20Overwrite
x_refsource_MISCExploitThird Party Advisory
https://www.provideserver.com/security/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4047		Advisory
https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20Admin%20Interface%20-%20Authenticated%20Arbitrary%20File%20Overwrite		x_refsource_MISCExploitThird Party Advisory
https://www.provideserver.com/security/		x_refsource_MISCVendor Advisory