CVE-2017-20101 ProjectSend information disclosure

Low 3.5 Published 27 Jun 2022 Updated 15 Apr 2025

Remote attackers can exploit ProjectSend to disclose sensitive information via the zip download process.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-20101?

CVE-2017-20101 is a low-severity vulnerability in unspecified ProjectSend, published on 27 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.

Weakness: CWE-639, CWE-200

Which versions are affected by CVE-2017-20101?

It affects 1 product.

Products include Projectsend Projectsend.

How do I fix CVE-2017-20101?

No fix has been published for CVE-2017-20101 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-20101 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-20101 exists.

Sources

Also known as GHSA-hj37-32jp-79fv.