CVE-2017-20101

MEDIUM EPSS 59.6%
Published Jun 27, 20224y ago · Modified Jun 17, 20262w ago
5.7 CVSS 3.1
Medium
Find Similar
Published Jun 27, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.

CVSS Details

Base Score
5.7
Exploitability
2.1
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
59.6% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-639

Affected Products 1

VendorProductVersionRange
projectsendprojectsendr754any

References 3

  • seclists.org http://seclists.org/fulldisclosure/2017/Feb/58
    ExploitMailing ListThird Party Advisory
  • vuldb.com https://vuldb.com/?id.97275
    Third Party Advisory
  • youtu.be https://youtu.be/Xc6Jg9I7Pj4
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.