CVE-2017-20101 - Vulnerability Details - OpenCVE

A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Projectsend	Projectsend

Configuration 1 [-]

cpe:2.3:a:projectsend:projectsend:r754:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2017/Feb/58
https://vuldb.com/?id.97275
https://youtu.be/Xc6Jg9I7Pj4

History

Wed, 16 Apr 2025 08:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2022-06-27T13:25:21.000Z

Updated: 2025-04-15T14:12:32.627Z

Reserved: 2022-06-25T00:00:00.000Z

Link: CVE-2017-20101

Vulnrichment

Updated: 2024-08-05T21:45:25.985Z

NVD

Status : Modified

Published: 2022-06-27T14:15:07.977

Modified: 2024-11-21T03:22:38.110

Link: CVE-2017-20101

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "ProjectSend", "vendor": "unspecified", "versions": [{"status": "affected", "version": "r754"}]}], "credits": [{"lang": "en", "value": "Lawrence Amer"}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Disclosure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-27T13:25:20.000Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://seclists.org/fulldisclosure/2017/Feb/58"}, {"tags": ["x_refsource_MISC"], "url": "https://youtu.be/Xc6Jg9I7Pj4"}, {"tags": ["x_refsource_MISC"], "url": "https://vuldb.com/?id.97275"}], "title": "ProjectSend information disclosure", "x_generator": "vuldb.com", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@vuldb.com", "ID": "CVE-2017-20101", "REQUESTER": "cna@vuldb.com", "STATE": "PUBLIC", "TITLE": "ProjectSend information disclosure"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ProjectSend", "version": {"version_data": [{"version_value": "r754"}]}}]}, "vendor_name": ""}]}}, "credit": "Lawrence Amer", "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely."}]}, "generator": "vuldb.com", "impact": {"cvss": {"baseScore": "3.5", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "http://seclists.org/fulldisclosure/2017/Feb/58", "refsource": "MISC", "url": "http://seclists.org/fulldisclosure/2017/Feb/58"}, {"name": "https://youtu.be/Xc6Jg9I7Pj4", "refsource": "MISC", "url": "https://youtu.be/Xc6Jg9I7Pj4"}, {"name": "https://vuldb.com/?id.97275", "refsource": "MISC", "url": "https://vuldb.com/?id.97275"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T21:45:25.985Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2017/Feb/58"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://youtu.be/Xc6Jg9I7Pj4"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://vuldb.com/?id.97275"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T17:07:46.011621Z", "id": "CVE-2017-20101", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T14:12:32.627Z"}}]}, "cveMetadata": {"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2017-20101", "datePublished": "2022-06-27T13:25:21.000Z", "dateReserved": "2022-06-25T00:00:00.000Z", "dateUpdated": "2025-04-15T14:12:32.627Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2017/Feb/58", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://youtu.be/Xc6Jg9I7Pj4", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://vuldb.com/?id.97275", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T21:45:25.985Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20101", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T17:07:46.011621Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T17:07:49.021Z"}}], "cna": {"title": "ProjectSend information disclosure", "credits": [{"lang": "en", "value": "Lawrence Amer"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "unspecified", "product": "ProjectSend", "versions": [{"status": "affected", "version": "r754"}]}], "references": [{"url": "http://seclists.org/fulldisclosure/2017/Feb/58", "tags": ["x_refsource_MISC"]}, {"url": "https://youtu.be/Xc6Jg9I7Pj4", "tags": ["x_refsource_MISC"]}, {"url": "https://vuldb.com/?id.97275", "tags": ["x_refsource_MISC"]}], "x_generator": "vuldb.com", "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Information Disclosure"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2022-06-27T13:25:20.000Z"}, "x_legacyV4Record": {"credit": "Lawrence Amer", "impact": {"cvss": {"version": "3.1", "baseScore": "3.5", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "r754"}]}, "product_name": "ProjectSend"}]}, "vendor_name": ""}]}}, "data_type": "CVE", "generator": "vuldb.com", "references": {"reference_data": [{"url": "http://seclists.org/fulldisclosure/2017/Feb/58", "name": "http://seclists.org/fulldisclosure/2017/Feb/58", "refsource": "MISC"}, {"url": "https://youtu.be/Xc6Jg9I7Pj4", "name": "https://youtu.be/Xc6Jg9I7Pj4", "refsource": "MISC"}, {"url": "https://vuldb.com/?id.97275", "name": "https://vuldb.com/?id.97275", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Disclosure"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-20101", "STATE": "PUBLIC", "TITLE": "ProjectSend information disclosure", "ASSIGNER": "cna@vuldb.com", "REQUESTER": "cna@vuldb.com"}}}}, "cveMetadata": {"cveId": "CVE-2017-20101", "state": "PUBLISHED", "dateUpdated": "2025-04-15T14:12:32.627Z", "dateReserved": "2022-06-25T00:00:00.000Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2022-06-27T13:25:21.000Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:projectsend:projectsend:r754:*:*:*:*:*:*:*", "matchCriteriaId": "CC26971D-4906-4B94-8BCE-19DC44BF2136", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad, clasificada como problem\u00e1tica, en ProjectSend versi\u00f3n r754. Esto afecta a una parte desconocida del archivo process.php?do=zip_download. La manipulaci\u00f3n del argumento cliente/archivo conlleva a una divulgaci\u00f3n de informaci\u00f3n. Es posible iniciar el ataque de forma remota"}], "id": "CVE-2017-20101", "lastModified": "2024-11-21T03:22:38.110", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-27T14:15:07.977", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Feb/58"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.97275"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://youtu.be/Xc6Jg9I7Pj4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Feb/58"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.97275"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://youtu.be/Xc6Jg9I7Pj4"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}]}