PT-2022-23714 · Ipswitch · Ws Ftp Server

Published 2022-08-02 · Updated 2022-08-09 · CVE-2022-36968

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions In Progress WS FTP Server versions prior to 8.7.3

Description The issue concerns forms within the administrative interface that did not include a nonce, which is used to mitigate the risk of cross-site request forgery (CSRF) attacks. CSRF attacks involve tricking a user into performing unintended actions on a web application that the user is authenticated to.

Recommendations For versions prior to 8.7.3, update to version 8.7.3 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to detect and prevent CSRF attacks, such as manually adding a nonce to forms or using other anti-CSRF techniques.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-36968

Affected Products

Ws Ftp Server

References · 6

• https://osv.dev/vulnerability/CVE-2022-36968 · Vendor Advisory
• https://progress.com/ws_ftp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36968 · Security Note
• https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022 · Vendor Advisory
• https://t.me/cvenotify/34177 · Telegram Post
• https://t.me/cibsecurity/47450 · Telegram Post