CVE-2020-28165

CRITICAL

Easycorp Zentao < 12.4.2 - Unrestricted File Upload

Title source: rule

Description

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.zentao.net/dynamic/zentaopms12.4.2-80263.html

Scores

CVSS v3 9.8

EPSS 0.0060

EPSS Percentile 69.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

easycorp/zentao < 12.4.2

Published Aug 12, 2021

Tracked Since Feb 18, 2026