CVE-2020-11704 details multiple stored and reflected cross-site scripting (XSS) vulnerabilities in ProVide (formerly zFTPServer) through version 13.1, specifically within its Admin Web Interface. These flaws allow for reflected XSS via the 'groups' parameter in GetInheritedProperties and POST data in GetUserInfo, as well as stored XSS via the 'general' parameter in SetUserInfo. With a CVSS score of 6.1 (Medium), exploitation requires user interaction (UI:R) and could lead to low impact on confidentiality and integrity (C:L, I:L). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 13.1CPE matchmatch criteria | cpe:2.3:a:provideserver:provide_ftp_server:*:*:*:*:*:windows:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.