PT-2023-6494 · Ipswitch · Ws Ftp Server

Published 2023-09-27 · Updated 2023-09-28 · CVE-2023-40046

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.7.4 WS FTP Server versions prior to 8.8.2

Description A SQL injection vulnerability exists in the WS FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Recommendations For WS FTP Server versions prior to 8.7.4, update to version 8.7.4 or later. For WS FTP Server versions prior to 8.8.2, update to version 8.8.2 or later. As a temporary workaround, consider restricting access to the WS FTP Server manager interface until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07240

CVE-2023-40046

Affected Products

Ws Ftp Server

References · 11

• https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40046 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40046 · Vendor Advisory
• https://twitter.com/fletch_ai/status/1707638093497446459 · Twitter Post
• https://twitter.com/cracbot/status/1707274010235686991 · Twitter Post
• https://progress.com/ws_ftp · Note
• https://twitter.com/CVEnew/status/1707051676283089045 · Twitter Post
• https://t.me/cvenotify/58637 · Telegram Post
• https://rapid7.com/db/vulnerabilities/progress-wsftp-cve-2023-40046 · Note
• https://rapid7.com/db/vulnerabilities/progress-wsftp-cve-2023-40046-remote · Note