CVE-2024-7744 MEDIUM

CVE-2024-7744: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server

Vendor Progress Software Corporation
Product WS_FTP Server
Weakness CWE-22 · Path traversal
Published August 28, 2024
Last update August 28, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.   An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)

Key dates

02Disclosure timeline

August 28, 2024 CVE published
August 28, 2024 Record updated