VulnerabilityModified

CVE-2023-40046

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface.

HIGH 7.2EPSS 0.85%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.85% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: progress/ws ftp server
Source: security@progress.com

References

https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023Vendor Advisory
https://www.progress.com/ws_ftpProduct
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023Vendor Advisory
https://www.progress.com/ws_ftpProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.