CVE-2020-11707

An issue was discovered in ProVide (formerly zFTPServer) through 13.1

published April 12, 2020

CVSS
—
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. It doesn't enforce permission over Windows Symlinks or Junctions. As a result, a low-privileged user (non-admin) can craft a Junction Link in a directory he has full control of, breaking out of the sandbox.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01003 · 62.6th percentile
Published
2020-04-12T02:42Z
EPSS history
Timeline
  • 12 APR 02:42Z
    An issue was discovered in ProVide (formerly zFTPServer) through 13.1
    cvelistv5