CVE-2023-40044

🗓️ 27 Sep 2023 14:48:08Reported by ProgressSoftwareType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 467 Views🌐 WEB

CVE-2023-40044: .NET deserialization vulnerability in WS_FTP Serve

Reporter	Title	Published	Views	Family All 27
zdt	Progress Software WS_FTP Unauthenticated Remote Code Execution Exploit	4 Oct 202300:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Progress Ws_Ftp_Server	2 Oct 202314:55	–	githubexploit
ATTACKERKB	CVE-2023-40044	27 Sep 202300:00	–	attackerkb
BDU FSTEC	The vulnerability of the Ad hoc Transfer Module of the WS_FTP Server allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.	6 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-40044	29 Sep 202308:31	–	circl
CISA KEV Catalog	Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability	5 Oct 202300:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	5 Oct 202312:00	–	cisa
CNNVD	Progress Software WS_FTP Server Code Issue Vulnerability	27 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-40044 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability	27 Sep 202314:48	–	cvelist
Imperva Blog	Recent Vulnerabilities in Popular Applications Blocked by Imperva	11 Oct 202322:46	–	impervablog

NVD

Node

progress ws_ftp_serverRange<8.7.4

progress ws_ftp_serverRange8.8–8.8.2

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Ad Hoc Transfer Module"
    ],
    "product": "WS_FTP Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "8.8.2",
        "status": "affected",
        "version": "8.8.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.7.4",
        "status": "affected",
        "version": "8.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
community	www.community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
progress	www.progress.com/ws_ftp
packetstormsecurity	www.packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html
theregister	www.theregister.com/2023/10/02/ws_ftp_update/
censys	www.censys.com/cve-2023-40044/
assetnote	www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
attackerkb	www.attackerkb.com/topics/bn32f9sNax/cve-2023-40044
rapid7	www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
AHT_DEFAULT_UPLOAD_PARAMETER	request body	/AHT/	Unauthenticated .NET deserialization vulnerability in WS_FTP Ad Hoc Transfer module leading to remote code execution via crafted multipart payload.	CWE-502
AHT_UPLOAD_PARAMETER	request body	/AHT/	Unauthenticated .NET deserialization vulnerability in WS_FTP Ad Hoc Transfer module leading to remote code execution via crafted multipart payload.	CWE-502

17 Jun 2026 06:15Current

9.3High risk

Vulners AI Score9.3

CVSS 3.18.8 - 10

EPSS0.9015

SSVC