PT-2020-12788 · Zftpserver · Provide

Published 2020-04-12 · Updated 2020-04-13 · CVE-2020-11701

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProVide (formerly zFTPServer) versions prior to 13.2

Description An issue exists in the User Web Interface of the affected software, where a CSRF condition allows granting filesystem access to the public. This access enables uploading and deleting files and directories.

Recommendations For ProVide (formerly zFTPServer) versions prior to 13.2, update to version 13.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Web Interface to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-11701

Affected Products

Provide

References · 5

• 🔥 https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Cross-Site%20Request%20Forgery · Exploit
• https://provideserver.com/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11701 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11701 · Vendor Advisory
• https://t.me/cvenotify/2656 · Telegram Post