PatchTheCVEzendto vulnerabilities and fixes
Recent CVEs affecting zendto, with upgrade or downgrade steps. 4 tracked.
zendto has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2020-03-24. Highest priority: CVE-2020-8986 (score 58/100).
- CVE-2020-8986 CRITICAL 9.8 DOWNGRADE lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the se
- CVE-2020-8985 HIGH 8.8 DOWNGRADE ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
- CVE-2020-8984 HIGH 7.5 DOWNGRADE lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
- CVE-2018-1000841 MEDIUM 6.1 UPGRADE Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page tha
FAQ
How do I fix zendto vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zendto being exploited right now?
None of the tracked zendto CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zendto CVE should I patch first?
CVE-2020-8986 currently ranks highest (58/100): lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the se.