CVE-2023-42657 CRITICAL

CVE-2023-42657: WS_FTP Server Directory Traversal

Vendor Progress Software Corporation
Product WS_FTP Server
Weakness CWE-22 · Path traversal
Published September 27, 2023
Last update September 24, 2024

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path.  Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.

Key dates

02Disclosure timeline

September 27, 2023 CVE published
September 24, 2024 Record updated