CVE-2009-4194

Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions allows remote authenticated users to delete arbitrary files via a .. (dot dot) in the DELE command. NOTE: some of these details are obtained from third party information.

CVSS v3 8.1 HIGH
CVSS v2.0 6.0 MEDIUM

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://blog.sat0ri.com/?p=292	Broken Link Exploit
http://secunia.com/advisories/37527	Broken Link Vendor Advisory
http://www.exploit-db.com/exploits/10258	Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/54497	Third Party Advisory VDB Entry
http://blog.sat0ri.com/?p=292	Broken Link Exploit
http://secunia.com/advisories/37527	Broken Link Vendor Advisory
http://www.exploit-db.com/exploits/10258	Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/54497	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kmint21:golden_ftp_server:4.30::::free:::
	cpe:2.3:a:kmint21:golden_ftp_server:4.50::::professional:::

History

21 Nov 2024, 01:09

Type	Values Removed	Values Added
References	~~() http://blog.sat0ri.com/?p=292 - Broken Link, Exploit~~	() http://blog.sat0ri.com/?p=292 - Broken Link, Exploit
References	~~() http://secunia.com/advisories/37527 - Broken Link, Vendor Advisory~~	() http://secunia.com/advisories/37527 - Broken Link, Vendor Advisory
References	~~() http://www.exploit-db.com/exploits/10258 - Exploit, Third Party Advisory, VDB Entry~~	() http://www.exploit-db.com/exploits/10258 - Exploit, Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/54497 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/54497 - Third Party Advisory, VDB Entry

26 Jan 2024, 17:54

Type	Values Removed	Values Added
CPE	cpe:2.3:a:kmint21:golden_ftp_server:4.50::pro::::: cpe:2.3:a:kmint21:golden_ftp_server:4.30::free:::::	cpe:2.3:a:kmint21:golden_ftp_server:4.30::::free::: cpe:2.3:a:kmint21:golden_ftp_server:4.50::::professional:::
CVSS	v2 : ~~6.0~~ v3 : ~~unknown~~	v2 : 6.0 v3 : 8.1
References	~~(EXPLOIT-DB) http://www.exploit-db.com/exploits/10258 - Exploit~~	(EXPLOIT-DB) http://www.exploit-db.com/exploits/10258 - Exploit, Third Party Advisory, VDB Entry
References	~~(MISC) http://blog.sat0ri.com/?p=292 - Exploit~~	(MISC) http://blog.sat0ri.com/?p=292 - Broken Link, Exploit
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/54497 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/54497 - Third Party Advisory, VDB Entry
References	~~(SECUNIA) http://secunia.com/advisories/37527 - Vendor Advisory~~	(SECUNIA) http://secunia.com/advisories/37527 - Broken Link, Vendor Advisory

Information

Published : 2009-12-03 19:30

Updated : 2024-11-21 01:09

NVD link : CVE-2009-4194

Mitre link : CVE-2009-4194

CVE.ORG link : CVE-2009-4194

JSON object : View

Products Affected

kmint21

golden_ftp_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

8.1 /10