CVE-2020-11707

Published: 2020-04-12T03:15Z

Last Modified: 2024-11-21T04:58Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. It doesn't enforce permission over Windows Symlinks or Junctions. As a result, a low-privileged user (non-admin) can craft a Junction Link in a directory he has full control of, breaking out of the sandbox. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt