CVE-2023-40046

2023-09-2715:18:58

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-40046

ws_ftp server

sql injection

vulnerability

nvd

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

In WS_FTP Server versions prior to 8.7.4 and 8.8.2,

a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Affected configurations

NVD

Node

progressws_ftp_serverRange<8.7.4

progressws_ftp_serverRange8.8–8.8.2

CPENameOperatorVersion
progress:ws_ftp_serverprogress ws ftp serverlt8.7.4
progress:ws_ftp_serverprogress ws ftp serverlt8.8.2

CPE	Name	Operator	Version
progress:ws_ftp_server	progress ws ftp server	lt	8.7.4
progress:ws_ftp_server	progress ws ftp server	lt	8.8.2

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Server Manager"
    ],
    "product": "WS_FTP Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "8.8.2",
        "status": "affected",
        "version": "8.8.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.7.4",
        "status": "affected",
        "version": "8.7.0",
        "versionType": "semver"
      }
    ]
  }
]