VulnerabilityModified

CVE-2023-42659

An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

HIGH 8.8EPSS 0.90%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.90% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: progress/ws ftp server
Source: security@progress.com

References

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023Vendor Advisory
https://www.progress.com/ws_ftpProduct
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023Vendor Advisory
https://www.progress.com/ws_ftpProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.