PT-2020-18296 · Cerberus · Cerberus Ftp Server

Published 2020-01-13 · Updated 2020-01-22 · CVE-2020-5195

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 11.0.1 Cerberus FTP Server versions prior to 10.0.17

Description The issue allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL, exploiting a Reflected XSS vulnerability through an IMG element. This occurs due to the folder up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The issue impacts anyone who clicks the malicious link crafted by the attacker.

Recommendations For versions prior to 11.0.1, update to version 11.0.1 or later. For versions prior to 10.0.17, update to version 10.0.17 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-5195

Affected Products

Cerberus Ftp Server

References · 5

• https://cerberusftp.com/xss-vulnerability-in-public-shares-fixed-in-cerberus-ftp-server-version-11-0-1-and-10-0-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5195 · Vendor Advisory
• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5195 · Security Note
• https://doyler.net/security-not-included/cerberus-ftp-vulnerabilities · Note