PT-2007-5008 · Netwin · Surgeftp

Publicado 2007-07-15 · Atualizado 2017-07-29 · CVE-2007-3769

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SurgeFTP version 2.3a1

Description A cross-site scripting (XSS) issue exists in the mirrored server management interface, allowing remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code. This injected content is reflected to the user in the resulting error message. It is possible to leverage this issue for root access through a sequence of steps involving web script that creates a new FTP user account.

Recommendations For SurgeFTP version 2.3a1, consider disabling the mirrored server management interface until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the management interface to minimize the risk of arbitrary web script or HTML injection.

Correção

Identificadores relacionados

CVE-2007-3769

Produtos afetados

Surgeftp

Referências · 7

• http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0031.txt · Nota
• http://vupen.com/english/advisories/2007/2528 · Nota
• http://secunia.com/advisories/26061 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3769 · Nota de Segurança
• http://osvdb.org/37911 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35378 · Nota
• http://marc.info/?l=full-disclosure&m=118409539009277&w=2 · Correção