PT-2024-31212 · Unknown · Titan Sftp+1

Mounir Aarab · Published 2024-09-13 · Updated 2024-09-13 · CVE-2024-44685

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Titan SFTP and Titan MFT Server versions 2.0.25.2426 and earlier

Description The issue concerns the exposure of sensitive information, including passwords, in clear text within the JSON response when configuring SMTP settings via the Web UI. This sensitive information exposure occurs in Titan SFTP and Titan MFT Server.

Recommendations For versions 2.0.25.2426 and earlier, consider restricting access to the Web UI until a fix is available, and avoid configuring SMTP settings via the Web UI to minimize the risk of sensitive information exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-44685

Affected Products

Titan Ftp Server

Titan Sftp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-44685 · Security Note
• https://twitter.com/VulmonFeeds/status/1834669090637562032 · Twitter Post
• https://github.com/ShellFighter/Reports/blob/main/Titan%20MFT%20Server.md · Note
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-cve-2024-44685 · Note
• https://twitter.com/CVEnew/status/1834633852696060016 · Twitter Post
• https://t.me/cvedetector/5621 · Telegram Post