CVE-2023-42657

WS_FTP Server Directory Traversal

State: Published
Severity: 9.9 Critical
Published: Sep 27, 2023
Updated: Sep 24, 2024
Reserved: Sep 12, 2023

Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
WS_FTP ServerProgress Software Corporation	8.8.0 to before 8.8.2Affected 8.7.0 to before 8.7.4Affected

References

https://www.progress.com/ws_ftpproduct
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.