VulnerabilityModified
CVE-2019-16116
EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file.
MEDIUM 4.3EPSS 3.68%
Does this matter?
Lower severity and a low EPSS score (3.68%). Track it; it rarely justifies an emergency change on its own.
Description
EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 3.68% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-327, CWE-532
- Affected
- enterprisedt/completeftp server
- Source
- cve@mitre.org
References
- https://enterprisedt.com/products/completeftp/doc/guide/html/history.htmlRelease Notes, Vendor Advisory
- https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/Exploit, Third Party Advisory
- https://enterprisedt.com/products/completeftp/doc/guide/html/history.htmlRelease Notes, Vendor Advisory
- https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.