CVE-2020-11701

HIGH

ProVide FTP Server < 13.1 - Cross-Site Request Forgery in User Web Interface

Title source: llm

Description

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. CSRF exists in the User Web Interface, as demonstrated by granting filesystem access to the public for uploading and deleting files and directories.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://www.provideserver.com/security/

Exploit, Third Party Advisory x_refsource_misc

https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Cross-Site%20Request%20Forgery

Scores

CVSS v3 8.8

EPSS 0.0050

EPSS Percentile 38.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

provideserver/provide_ftp_server < 13.1

Published Apr 12, 2020

Tracked Since Feb 18, 2026