CVE-2020-5195

Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 11.0.1 Cerberus FTP Server versions prior to 10.0.17

Description The issue allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL, exploiting a Reflected XSS vulnerability through an IMG element. This occurs due to the folder up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The issue impacts anyone who clicks the malicious link crafted by the attacker.

Recommendations For versions prior to 11.0.1, update to version 11.0.1 or later. For versions prior to 10.0.17, update to version 10.0.17 or later.