PT-2015-3488 · Easewe · Easewe Ftp Ocx
Published
2015-01-01
·
Updated
2015-01-03
·
CVE-2011-5292
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Easewe FTP OCX version 4.5.0.9
Description
The issue concerns the EaseWeFtp.FtpLibrary ActiveX control, which does not properly restrict access to certain methods. This allows remote attackers to execute arbitrary files via the
Execute or Run method, write to arbitrary files via the CreateLocalFile method, create arbitrary directories via the CreateLocalFolder method, or delete arbitrary files via the DeleteLocalFile method.Recommendations
For Easewe FTP OCX version 4.5.0.9, consider restricting access to the vulnerable methods
Execute, Run, CreateLocalFile, CreateLocalFolder, and DeleteLocalFile until a patch is available. As a temporary workaround, avoid using these methods with untrusted input to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Easewe Ftp Ocx