PT-2022-17393 · Enterprisedb · Enterprisedt Completeftp

Rgod · Published 2022-07-28 · Updated 2025-02-18 · CVE-2022-2560

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions EnterpriseDT CompleteFTP version 22.1.0 Server

Description This issue allows remote attackers to delete arbitrary files on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the HttpFile class, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to delete files in the context of SYSTEM.

Recommendations For EnterpriseDT CompleteFTP version 22.1.0 Server, as a temporary workaround, consider restricting access to the HttpFile class until a patch is available. Avoid using user-supplied paths in file operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-2560

ZDI-22-1032

Affected Products

Enterprisedt Completeftp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-2560 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2560 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1032 · Security Note
• https://t.me/cvenotify/47684 · Telegram Post
• https://t.me/cvenotify/48738 · Telegram Post
• https://t.me/cvenotify/111634 · Telegram Post