Arbitrary File Upload Vulnerability in EasyCorp ZenTao PMS Application
CVE-2020-28165

9.8CRITICAL

Key Information:

Vendor

Easycorp

Status
Zentao
Vendor
CVE Published:
12 August 2021

What is CVE-2020-28165?

The EasyCorp ZenTao PMS application version 12.4.2 is susceptible to an arbitrary file upload vulnerability. This flaw allows attackers to upload malicious files, such as webshells, to the server through the compromised downloadZipPackage() function. Exploiting this vulnerability can enable unauthorized access, remote code execution, and potential takeover of the affected server. It is crucial for users of this version to apply security measures to mitigate the risk of exploitation.

References

https://www.zentao.net/dynamic/zentaopms12.4.2-80263.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.