Improper access control in FTP Server - CVE-2020-5196

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the "zip" and "unzip" functions in the FTP Server Enterprise Edition. A remote authenticated attacker can bypass the create directory, display hidden, list directories, and list files permissions, leading to creating directories or viewing hidden information.

Affected software

How to mitigate CVE-2020-5196

External References

• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-Announcements
• https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities

Related Security Bulletins

• Improper access control in Cerberus FTP Server