Lucene search

ProgressSoftwareCVE-2024-7744

HistoryAug 28, 2024 - 5:15 p.m.

CVE-2024-7744

2024-08-2817:15:11

CWE-73

CWE-22

ProgressSoftware

web.nvd.nist.gov

ws_ftp server

path traversal

file discovery

authenticated

api call

file download

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

19.8%

JSON

In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.

An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host’s root folder is located (by default this is C:)

Affected configurations

Nvd

Node

progressws_ftp_serverRange<8.8.8

VendorProductVersionCPE
progressws_ftp_server*cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
progress	ws_ftp_server	*	cpe:2.3:a:progress:ws_ftp_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Web Transfer Module"
    ],
    "platforms": [
      "Windows"
    ],
    "product": "WS_FTP Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "8.8.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024

www.progress.com/ftp-server

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

19.8%

JSON

Related for CVE-2024-7744