CVE-2020-8986
CRITICALCVSS 9.8/10EPSS 1.54%
Last modified
CVE-2020-8986 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.. EPSS estimates a 1.54% chance of exploitation in the next 30 days.
Description
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Zend | Zendto | 3.10 | — |
| Zend | Zendto | 3.11 | — |
| Zend | Zendto | 3.12 | — |
| Zend | Zendto | 3.13 | — |
| Zend | Zendto | 3.20 | — |
| Zend | Zendto | 3.51 | — |
| Zend | Zendto | 3.52 | — |
| Zend | Zendto | 3.53 | — |
| Zend | Zendto | 3.54 | — |
| Zend | Zendto | 3.55 | — |
| Zend | Zendto | 3.56-2 | — |
| Zend | Zendto | 3.57 | — |
| Zend | Zendto | 3.58 | — |
| Zend | Zendto | 3.59 | — |
| Zend | Zendto | 3.60 | — |
| Zend | Zendto | 3.61 | — |
| Zend | Zendto | 3.62 | — |
| Zend | Zendto | 3.63 | — |
| Zend | Zendto | 3.64 | — |
| Zend | Zendto | 3.65 | — |
| Zend | Zendto | 3.70-2 | — |
| Zend | Zendto | 3.71 | — |
| Zend | Zendto | 3.72 | — |
| Zend | Zendto | 3.73 | — |
| Zend | Zendto | 3.74 | — |
| Zend | Zendto | 3.75 | — |
| Zend | Zendto | 3.90 | — |
| Zend | Zendto | 3.91 | — |
| Zend | Zendto | 3.92 | — |
| Zend | Zendto | 3.93 | — |
| Zend | Zendto | 3.94 | — |
| Zend | Zendto | 4.00 | — |
| Zend | Zendto | 4.01 | — |
| Zend | Zendto | 4.02 | — |
| Zend | Zendto | 4.03-3 | — |
| Zend | Zendto | 4.05-2 | — |
| Zend | Zendto | 4.06-2 | — |
| Zend | Zendto | 4.07-1 | — |
| Zend | Zendto | 4.08-4 | — |
| Zend | Zendto | 4.09-1 | — |
| Zend | Zendto | 4.10-4 | — |
| Zend | Zendto | 4.10-5 | — |
| Zend | Zendto | 4.11-1 | — |
| Zend | Zendto | 4.11-2 | — |
| Zend | Zendto | 4.11-3 | — |
| Zend | Zendto | 4.11-4 | — |
| Zend | Zendto | 4.11-5 | — |
| Zend | Zendto | 4.11-7 | — |
| Zend | Zendto | 4.11-8 | — |
| Zend | Zendto | 4.11-9 | — |
Showing 50 of 123 affected configurations. See NVD for the full list.
References
- https://zend.to/changelog.phpRelease Notes, Vendor Advisory
- https://zend.to/changelog.phpRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8986?
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
How severe is CVE-2020-8986?
CVE-2020-8986 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.54% probability of exploitation in the next 30 days.
How do I fix CVE-2020-8986?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-8976The integrated server of the ZGR TPS200 NG on its 2.00 firmw…8.8
- CVE-2020-8981A cross-site scripting (XSS) vulnerability was discovered in…6.1
- CVE-2020-8982An unauthenticated arbitrary file read issue exists in all v…7.5
- CVE-2020-8983An arbitrary file write issue exists in all versions of Citr…7.5
- CVE-2020-8984lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP…7.5
- CVE-2020-8985ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF v…8.8
- CVE-2020-8987Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.…7.4
- CVE-2020-8988The Voatz application 2020-01-01 for Android allows only 100…5.9
- CVE-2020-8989In the Voatz application 2020-01-01 for Android, the amount …5.3
- CVE-2020-8990Western Digital My Cloud Home before 3.6.0 and ibi before 3.…9.1
- CVE-2020-8991vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mis…2.3
- CVE-2020-8992ext4_protect_reserved_inode in fs/ext4/block_validity.c in t…5.5
Are you affected by CVE-2020-8986?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST