Security readout for executives and security teams
Plain-English summary
ZenTao PMS 12.4.2 is reported to allow arbitrary file upload. The description says an attacker could upload a webshell through the downloadZipPackage() function, which may let them control the affected server. Public sources do not provide CVSS scoring, confirmed exploitation, or a complete affected-version list.
Executive priority
Treat this as high priority for any exposed ZenTao PMS 12.4.2 system because the reported outcome is webshell upload. Urgency is lower where ZenTao is absent or isolated, but evidence gaps require direct inventory confirmation.
Technical view
CVE-2020-28165 describes arbitrary file upload in EasyCorp ZenTao PMS 12.4.2 involving downloadZipPackage(). The reported impact is webshell upload to the server. The source bundle does not include CWE mapping, CPEs, authentication requirements, attack complexity, or a named fixed version.
Likely exposure
Likely exposure is limited to organizations running EasyCorp ZenTao PMS 12.4.2, especially internet-accessible deployments. The sources do not identify other affected versions or provide product CPE data.
Exploitation context
CISA KEV status is false, and the supplied sources do not claim active exploitation. The described webshell upload outcome is serious because it can imply server compromise if the vulnerable function is reachable.
Researcher notes
The public record is sparse. It names ZenTao PMS 12.4.2 and downloadZipPackage(), but omits CVSS, CWE, fixed version, preconditions, and exploit status. Avoid assuming broader version impact without vendor evidence.
Mitigation direction
- Inventory ZenTao PMS deployments and confirm whether version 12.4.2 is present.
- Check EasyCorp or ZenTao guidance for fixed versions or vendor-approved remediation.
- Restrict external access to affected ZenTao instances during assessment.
- Review webroot and upload locations for unexpected executable files.
- Isolate or retire exposed vulnerable instances if remediation cannot be confirmed.
Validation and detection
- Confirm installed ZenTao PMS versions from asset inventory and application metadata.
- Review application and web server logs for suspicious package-related activity.
- Look for unexpected server-side scripts in web-accessible directories.
- Verify whether vendor guidance has been applied to each affected instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
File access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-28165 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.zentao.net/dynamic/zentaopms12.4.2-80263.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.