PT-2019-12658 · Ipswitch · Ws Ftp Server

Published 2019-06-11 · Updated 2019-06-12 · CVE-2019-12146

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Progress ipswitch WS FTP Server versions prior to 8.6.1

Description A Directory Traversal issue was discovered in SSHServerAPI.dll. Attackers can abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.

Recommendations For versions prior to 8.6.1, update to version 8.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCP listener to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-12146

Affected Products

Ws Ftp Server

References · 3

• https://osv.dev/vulnerability/CVE-2019-12146 · Vendor Advisory
• https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12146 · Security Note