CVE-2023-42659

WS_FTP Server Arbitrary File Upload

State: Published
Severity: 9.1 Critical
Published: Nov 7, 2023
Updated: Sep 4, 2024
Reserved: Sep 12, 2023

Description

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L	ProgressSoftware

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WS_FTP ServerProgress Software Corporation	8.8.0 to before 8.8.4Affected 8.7.0 to before 8.7.6Affected

References

https://www.progress.com/ws_ftpproduct
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.