CVE-2020-5195

Katalog CVE

CVSS 6.1 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cerberusftp ftp server. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker.

Rincian

Terbit di NVD

13 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements release notes · advisory vendor
• https://www.cerberusftp.com/xss-vulnerability-in-public-shares-fixed-in-cerberus-ftp-server-version-11-0-1-and... advisory vendor
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities advisory pihak ketiga