CVE-2023-40048 WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability

2023-09-2714:51:35

CWE-352

ProgressSoftware

www.cve.org

ws_ftp server

csrf

vulnerability

version 8.8.2

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.0%

JSON

In WS_FTP Server version prior to 8.8.2,

the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Server Manager"
    ],
    "product": "WS_FTP Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "8.8.2",
        "status": "affected",
        "version": "8.8.0",
        "versionType": "semver"
      }
    ]
  }
]