The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper limitation of the path name for the restricted access directory. This allows a perpetrator to obtain an arbitrary file size from the file system.

🗓️ 20 Oct 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Titan SFTP and Titan MFT NextGen improperly restrict the directory path, enabling remote attackers to obtain file sizes.

Reporter	Title	Published	Views	Family All 54
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to read arbitrary files from the file system.	19 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to write files to any location within the file system.	20 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper session management, allowing attackers to execute arbitrary code.	20 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Titan SFTP and Titan MFT NextGen server software lies in improper default permissions, allowing unauthorized access by attackers to protected information.	20 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-45685	16 Oct 202320:31	–	circl
Circl	CVE-2023-45688	16 Oct 202320:31	–	circl
Circl	CVE-2023-45690	16 Oct 202320:32	–	circl
CNNVD	South River Technologies TitanFTP NextGen Security Vulnerability	16 Oct 202300:00	–	cnnvd
CNNVD	South River Technologies Titan MFT and Titan SFTP Path Traversal Vulnerabilities	16 Oct 202300:00	–	cnnvd
CNNVD	South River Technologies Titan MFT and Titan SFTP Authorization Issues Vulnerability	16 Oct 202300:00	–	cnnvd

Vulners

Node

south_river_technologies titan_sftpRange<2.0.18

OR

south_river_technologies titan_mft_nextgenRange<2.0.18

Source	Link
helpdesk	www.helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
rapid7	www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
vuldb	www.vuldb.com/ru/
web	www.web.nvd.nist.gov/view/vuln/detail

20 Oct 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24

CVSS 34.3

EPSS0.01481

Titan SFTP Titan MFT NextGen restricted directory path arbitrary file size remote attacker size command