VULNERABILITY INTELLIGENCE

CVE-2020-7361

CVSS score9.6 CRITICAL
EPSS probability17.22%
CISA KEVNot currently listed
Published2020-08-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Description

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

Weakness classification

  • cve@rapid7.com: CWE-78
  • nvd@nist.gov: CWE-78

Primary references