CVE-2020-11702

Опубликовано: 12 апр. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter. Share is Reflected via the target parameter. Share is Stored via the displayname parameter. Waitedit is Reflected via the Host header.

Ссылки

https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Multiple%20Cross-Site-Scripting
Exploit
Third Party Advisory
https://www.provideserver.com/security/
Vendor Advisory
https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Multiple%20Cross-Site-Scripting
Exploit
Third Party Advisory
https://www.provideserver.com/security/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:provideserver:provide_ftp_server:*:*:*:*:*:windows:*:*

Версия до 13.1 (включая)

EPSS

Процентиль: 61%

0.00421

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-7r52-55rr-f92g

github

больше 3 лет назад