CVE-2023-40046

WS_FTP Server SQL Injection via Administrative Interface

State: Published
Severity: 8.2 High
Published: Sep 27, 2023
Updated: Sep 23, 2024
Reserved: Aug 8, 2023

Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2,

a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L	ProgressSoftware

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
WS_FTP ServerProgress Software Corporation	8.8.0 to before 8.8.2Affected 8.7.0 to before 8.7.4Affected

References

https://www.progress.com/ws_ftpproduct
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.