PT-2022-23713 · Ipswitch · Ws Ftp Server

Published 2022-08-02 · Updated 2022-08-10 · CVE-2022-36967

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.7.3

Description The administrative web interface of WS FTP Server contains multiple reflected cross-site scripting (XSS) vulnerabilities. A remote attacker can inject arbitrary JavaScript into a WS FTP administrator's web session, allowing the execution of code within the context of the victim's browser.

Recommendations For versions prior to 8.7.3, update to version 8.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative web interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36967

Affected Products

Ws Ftp Server

References · 7

• https://progress.com/ws_ftp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36967 · Security Note
• https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36967 · Vendor Advisory
• https://t.me/cvenotify/34178 · Telegram Post
• https://t.me/cvenotify/34494 · Telegram Post
• https://t.me/cibsecurity/47451 · Telegram Post