CVE-2023-42657 WS_FTP Server Directory Traversal
CriticalCVSS 9.6
- Published
- Updated
- Exploit status
- No public exploit known
Description
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Progress Software WS_FTP Server | >= 8.8.0, < 8.8.2 | 8.8.2 |
| Progress Software WS_FTP Server | >= 8.7.0, < 8.7.4 | 8.7.4 |
| progress ws ftp server | >= 8.8.0, < 8.8.2 | 8.8.2 |
| progress ws ftp server | >= 8.7.0, < 8.7.4 | 8.7.4 |
| progress ws ftp server | < 8.7.4 | 8.7.4 |
References
- www.progress.com product
- community.progress.com vendor-advisory