PT-2024-38552 · Ipswitch · Ws Ftp Server

Published 2024-08-28 · Updated 2024-09-04 · CVE-2024-7744

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.8.8 (2022.0.8)

Description A vulnerability in the Web Transfer Module of WS FTP Server allows for Path Traversal, enabling file discovery, probing of system files, and user-controlled filename manipulation. An authenticated file download flaw has been identified, where a user can craft an API call to download a file from an arbitrary folder on the drive where the user host's root folder is located, which by default is the C: drive.

Recommendations For WS FTP Server versions prior to 8.8.8 (2022.0.8), update to version 8.8.8 (2022.0.8) or later to resolve the issue. As a temporary workaround, consider restricting access to the Web Transfer Module until a patch is applied. Additionally, restrict the ability for users to craft API calls that allow them to download files from arbitrary folders.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2024-7744

ZDI-24-1184

Affected Products

Ws Ftp Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-7744 · Security Note
• https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1184 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7744 · Vendor Advisory
• https://t.me/cvenotify/92533 · Telegram Post
• https://twitter.com/CVEnew/status/1828836205468807539 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1828865482377629941 · Twitter Post
• https://twitter.com/CVESource/status/1828849451374383359 · Twitter Post
• https://progress.com/ftp-server · Note
• https://t.me/cvedetector/4338 · Telegram Post