CVE-2020-5194

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.

• CWE-639

• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-AnnouncementsVendor Advisory
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilitiesExploit, Third Party Advisory
• https://support.cerberusftp.com/hc/en-us/community/topics/360000164199-AnnouncementsVendor Advisory
• https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilitiesExploit, Third Party Advisory

Published

Jan 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5186DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 …5.4
• CVE-2020-5187DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversa…8.8
• CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permiss…6.5
• CVE-2020-5191PHPGurukul Hospital Management System in PHP v4.0 suffers fr…6.1
• CVE-2020-5192PHPGurukul Hospital Management System in PHP v4.0 suffers fr…8.8
• CVE-2020-5193PHPGurukul Hospital Management System in PHP v4.0 suffers fr…6.1
• CVE-2020-5195Reflected XSS through an IMG element in Cerberus FTP Server …6.1
• CVE-2020-5196Cerberus FTP Server Enterprise Edition prior to versions 11.…8.1
• CVE-2020-5197An issue was discovered in GitLab Community Edition (CE) and…4.3
• CVE-2020-5200Minerbabe through V4.16 ships with SSH host keys baked into …5.9
• CVE-2020-5202apt-cacher-ng through 3.3 allows local users to obtain sensi…5.5
• CVE-2020-5203In Fat-Free Framework 3.7.1, attackers can achieve arbitrary…9.8