An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter. Share is Reflected via the target parameter. Share is Stored via the displayname parameter. Waitedit is Reflected via the Host header.
References
| Link | Resource |
|---|---|
| https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Multiple%20Cross-Site-Scripting | Exploit Third Party Advisory |
| https://www.provideserver.com/security/ | Vendor Advisory |
| https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Multiple%20Cross-Site-Scripting | Exploit Third Party Advisory |
| https://www.provideserver.com/security/ | Vendor Advisory |
Configurations
History
21 Nov 2024, 04:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Web%20User%20Interface%20-%20Multiple%20Cross-Site-Scripting - Exploit, Third Party Advisory | |
| References | () https://www.provideserver.com/security/ - Vendor Advisory |
Information
Published : 2020-04-12 03:15
Updated : 2024-11-21 04:58
NVD link : CVE-2020-11702
Mitre link : CVE-2020-11702
CVE.ORG link : CVE-2020-11702
JSON object : View
Products Affected
provideserver
- provide_ftp_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')