Vulnerability · Published Nov 7, 2023 · Assigned by ProgressSoftware
CVE-2023-42659WS_FTP Server Arbitrary File Upload
Critical 9.1
In plain English
A critical-severity unrestricted file upload in WS_FTP Server from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.9%top 40.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | WS_FTP Server | 8.8.0 – before 8.8.48.7.0 – before 8.7.6 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L