PT-2019-12658 · Ipswitch · Ws Ftp Server

Publicado 2019-06-11 · Atualizado 2019-06-12 · CVE-2019-12146

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Progress ipswitch WS FTP Server versions prior to 8.6.1

Description A Directory Traversal issue was discovered in SSHServerAPI.dll. Attackers can abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.

Recommendations For versions prior to 8.6.1, update to version 8.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCP listener to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-12146

Produtos afetados

Ws Ftp Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-12146 · Aviso do Fabricante
• https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12146 · Nota de Segurança