CVE-2020-7361 CRITICAL

CVE-2020-7361: ZenTao Pro Command Injection

Vendor Easycorp
Product ZenTao Pro
Weakness CWE-78
Published August 6, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

Key dates

02Disclosure timeline

August 6, 2020 CVE published
September 16, 2024 Record updated