In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.
An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)
References
Link | Resource |
---|---|
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 | Vendor Advisory |
https://www.progress.com/ftp-server | Product |
Configurations
History
04 Sep 2024, 17:57
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* | |
First Time |
Progress
Progress ws Ftp Server |
|
References | () https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 - Vendor Advisory | |
References | () https://www.progress.com/ftp-server - Product |
29 Aug 2024, 13:25
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
28 Aug 2024, 17:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-28 17:15
Updated : 2024-09-04 17:57
NVD link : CVE-2024-7744
Mitre link : CVE-2024-7744
CVE.ORG link : CVE-2024-7744
JSON object : View
Products Affected
progress
- ws_ftp_server