1. Home
  2. CVE Database
  3. CVE-2020-7361
CRITICAL · 9.6

CVE-2020-7361

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct a...

Vulnerability Description

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

CVSS Score

9.6

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
EasycorpZentao Pro<= 8.8.2

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2020-7361?

CVE-2020-7361 is a vulnerability with a CVSS score of 9.6 (CRITICAL). The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct a...

How severe is CVE-2020-7361?

CVE-2020-7361 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-7361?

Check the references section above for vendor advisories and patch information. Affected products include: Easycorp Zentao Pro.