CVE-2020-5196

HIGH

Cerberus FTP Server 10.0.0-10.0.17 - Authenticated Permission Bypass via Zip/Unzip Features

Title source: llm

Description

Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements

Exploit, Third Party Advisory x_refsource_misc

https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities

Vendor Advisory x_refsource_misc

https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/

Scores

CVSS v3 8.1

EPSS 0.0120

EPSS Percentile 64.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-276

Status published

Products (1)

cerberusftp/ftp_server 10.0.0 - 10.0.18

Published Jan 14, 2020

Tracked Since Feb 18, 2026