In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.
An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)
References
| Link | Resource |
|---|---|
| https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 | Vendor Advisory |
| https://www.progress.com/ftp-server | Product |
Configurations
History
04 Sep 2024, 17:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Progress
Progress ws Ftp Server |
|
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* | |
| References | () https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 - Vendor Advisory | |
| References | () https://www.progress.com/ftp-server - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
28 Aug 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-28 17:15
Updated : 2024-09-04 17:57
NVD link : CVE-2024-7744
Mitre link : CVE-2024-7744
JSON object : View
Products Affected
progress
- ws_ftp_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')