CVE-2020-14057

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-610

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-01_Monsta_FTP_Arbitrary_File_Read_and_WriteThird Party Advisory
https://www.monstaftp.com/notes/Release Notes, Vendor Advisory
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-01_Monsta_FTP_Arbitrary_File_Read_and_WriteThird Party Advisory
https://www.monstaftp.com/notes/Release Notes, Vendor Advisory

Timeline

Published: Jul 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-140587.5An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default cer CVE-2020-140596.5An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing object CVE-2020-14067.8An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows Netw CVE-2020-140608.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac CVE-2020-140618.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQ CVE-2020-140628.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.a CVE-2020-140636.1A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot CVE-2020-140646.5IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.CVE-2020-140656.5IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.CVE-2020-140668.8IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.CVE-2020-140679.8The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive tha CVE-2020-140689.8An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges