PT-2017-15109 · Surgeftp · Surgeftp

Published 2017-12-29 · Updated 2021-09-10 · CVE-2017-17933

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SurgeFTP version 23f2

Description The issue concerns the Web Manager interface, specifically the cgi/surgeftpmgr.cgi, which is accessible on TCP port 7021 or 9021. It is susceptible to XSS attacks through the classid, domainid, or username parameters.

Recommendations For SurgeFTP version 23f2, consider restricting access to the Web Manager interface until a fix is available. As a temporary workaround, avoid using the classid, domainid, or username parameters in the vulnerable cgi/surgeftpmgr.cgi interface.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-17933

Affected Products

Surgeftp

References · 3

• 🔥 https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17933 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17933 · Vendor Advisory