9.8

CVE-2020-8986: zend zendto

CVSS: 9.8v3.1CriticalModified
Published 24-03-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-8986 is a critical (CVSS 9.8) vulnerability in zend zendto. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 74.7% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
1.54%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 24-03-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

1.54%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.54% on 22-09-2026

22-09-202622-10-2026
EPSS score
1.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Zend1 product
  • zendto3.10 | 3.11 | 3.12 | 3.13 | 3.20 | 3.51 | 3.52 | 3.53 | 3.54 | 3.55 | 3.56-2 | 3.57 | 3.58 | 3.59 | 3.60 | 3.61 | 3.62 | 3.63 | 3.64 | 3.65 | 3.70-2 | 3.71 | 3.72 | 3.73 | 3.74 | 3.75 | 3.90 | 3.91 | 3.92 | 3.93 | 3.94 | 4.00 | 4.01 | 4.02 | 4.03-3 | 4.05-2 | 4.06-2 | 4.07-1 | 4.08-4 | 4.09-1 | 4.10-4 | 4.10-5 | 4.11-1 | 4.11-2 | 4.11-3 | 4.11-4 | 4.11-5 | 4.11-7 | 4.11-8 | 4.11-9 | 4.11-10 | 4.11-11 | 4.11-12 | 4.11-13 | 4.11-14 | 4.12-5 | 4.12-6 | 4.13-1 | 4.20-2 | 4.20-3 | 4.20-5 | 4.20-6 | 4.20-7 | 4.25-3 | 4.27-1 | 4.27-2 | 4.27-4 | 4.27-5 | 4.27-6 | 4.27-7 | 4.28-1 | 4.28-2 | 5.00-1 | 5.00-2 | 5.01-5 | 5.02-5 | 5.03-1 | 5.04-7 | 5.09-13 | 5.10-1 | 5.10-2 | 5.11-1 | 5.11-2 | 5.11-3 | 5.11-4 | 5.11-5 | 5.11-6 | 5.12-3:beta | 5.12-4:beta | 5.12-6:beta | 5.12-7:beta | 5.12-8:beta | 5.13-1 | 5.13-2 | 5.14-2:beta | 5.14-5:beta | 5.15-1 | 5.16-1:beta | 5.16-4:beta | 5.16-5:beta | 5.16-7:beta | 5.16-8:beta | 5.16.6:beta | 5.17-1 | 5.17-2 | 5.17-3 | 5.17-4 | 5.17-5:beta | 5.17-6 | 5.18-1:beta | 5.18-2:beta | 5.19-1:production | 5.20-1:beta | 5.20-2:beta | 5.20-3:beta | 5.20-5:beta | 5.20-6:beta | 5.20-7:beta | 5.20-8:beta | 5.20-9:beta | 5.21-1:production | 5.21-2:production | 5.22-1:beta

1 vendor · 1 product

References

1 links