PT-2019-14520 · Enterprisedb · Enterprisedt Completeftp Server

Robert Fisher · Published 2019-10-01 · Updated 2021-07-21 · CVE-2019-16116

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EnterpriseDT CompleteFTP Server versions prior to 12.1.3

Description The issue allows an attacker to obtain the administrator password hash due to information exposure in the Bootstrap.log file.

Recommendations For EnterpriseDT CompleteFTP Server versions prior to 12.1.3, update to version 12.1.3 or later to resolve the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Insertion into Log File

Weakness Enumeration

CWE-327

CWE-532

Related Identifiers

CVE-2019-16116

Affected Products

Enterprisedt Completeftp Server

References · 9

• 🔥 https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116 · Exploit
• 🔥 https://exploit-db.com/exploits/48657 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16116 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16116 · Vendor Advisory
• https://enterprisedt.com/products/completeftp/doc/guide/html/history.html · Vendor Advisory
• https://t.me/canyoupwnme/6008 · Telegram Post
• https://t.me/rnetsec/10555 · Telegram Post
• https://t.me/secharvester/7596 · Telegram Post
• https://t.me/defcon_news/26046 · Telegram Post