Multi Server
CVE-2020-13227
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism.
AnalysisAI
An issue was discovered in Sysax Multi Server 6.90. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism. Affected products include: Sysax Multi Server.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.
More in Multi Server
View allSysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. Rated critical seve
Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users w
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. Rated high severity (CVS
Sysax Multi Server 6.95 crashes when the admin password field receives 800 bytes, causing denial of service. PoC availab
An issue was discovered in Sysax Multi Server 6.90. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packe
When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uplo
An issue was discovered in Sysax Multi Server 6.90. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. Rated medium severity (
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today