PT-2020-13868 · Monstra · Monstaftp

David Gnedt · Published 2020-07-01 · Updated 2020-07-08 · CVE-2020-14057

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monsta FTP versions 2.10.1 and earlier

Description The issue allows external control of paths used in filesystem operations, enabling attackers to read and write arbitrary local files. This can lead to an attacker gaining remote code execution in common deployments.

Recommendations For Monsta FTP versions 2.10.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-610

Related Identifiers

CVE-2020-14057

Affected Products

Monstaftp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-14057 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14057 · Vendor Advisory
• https://monstaftp.com/notes · Vendor Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-01_Monsta_FTP_Arbitrary_File_Read_and_Write · Note
• https://t.me/cvenotify/4782 · Telegram Post