CVE-2020-12737: 
Rumpus vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2020-12737) was discovered in Maxum Rumpus before version 8.2.12 on macOS. The vulnerability allows authenticated users to perform path traversal attacks using double escaped characters, which enables read access to arbitrary files on the server (CVE Details).

The vulnerability exists in the file access mechanism of Rumpus FTP server. Authenticated users can exploit this vulnerability by using double escaped characters in URLs to traverse directory paths. For example, using encoded sequences like %252e%252e%252f (representing '../') multiple times allows an attacker to navigate outside the intended directory structure (GitHub POC).

When successfully exploited, this vulnerability allows authenticated users to read arbitrary files on the server system, potentially exposing sensitive system files and configurations. This could lead to unauthorized access to critical system information (CVE Details).

The vulnerability requires authentication to exploit, which somewhat limits its impact. A proof of concept exists demonstrating how to access the /etc/passwd file through path traversal using specifically crafted URLs (GitHub POC).

The vulnerability has been patched in Rumpus version 8.2.12 and later. Users running affected versions should upgrade to the latest version to mitigate this security risk (Maxum Rumpus).