The vulnerability of the Ad hoc Transfer Module of the WS_FTP Server allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

🗓️ 06 Oct 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Ad hoc Transfer Module in WS_FTP Server has a deserialization flaw risking data confidentiality, integrity, and accessibility.

Reporter	Title	Published	Views	Family All 27
0day.today	Progress Software WS_FTP Unauthenticated Remote Code Execution Exploit	4 Oct 202300:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Progress Ws_Ftp_Server	2 Oct 202314:55	–	githubexploit
ATTACKERKB	CVE-2023-40044	27 Sep 202300:00	–	attackerkb
Circl	CVE-2023-40044	29 Sep 202308:31	–	circl
CISA KEV Catalog	Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability	5 Oct 202300:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	5 Oct 202312:00	–	cisa
CNNVD	Progress Software WS_FTP Server Code Issue Vulnerability	27 Sep 202300:00	–	cnnvd
CVE	CVE-2023-40044	27 Sep 202314:48	–	cve
Cvelist	CVE-2023-40044 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability	27 Sep 202314:48	–	cvelist
Imperva Blog	Recent Vulnerabilities in Popular Applications Blocked by Imperva	11 Oct 202322:46	–	impervablog

Vulners

Node

ipswitch ws_ftp_serverRange<8.7.4

OR

ipswitch ws_ftp_serverRange8.8–8.8.2

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html
attackerkb	www.attackerkb.com/topics/bn32f9sNax/cve-2023-40044
censys	www.censys.com/cve-2023-40044/
community	www.community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
assetnote	www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
progress	www.progress.com/ws_ftp
rapid7	www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/
theregister	www.theregister.com/2023/10/02/ws_ftp_update/
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 210

CVSS 310

EPSS0.94436

ad hoc transfer deserialization flaw file transfer server data confidentiality data integrity data accessibility