by Kastro
Paper/Archive/CVE-2020-28165

CVE-2020-28165

mitre — The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refzentao.net/dynamic/zentaopms12.4.2-80263.html