CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

🗓️ 16 Oct 2023 16:20:52Reported by rapid7Type

Information leak via default file permissions on Titan MFT and Titan SFTP servers. User can read sensitive files on filesyste

Reporter	Title	Published	Views	Family All 44
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to read arbitrary files from the file system.	19 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to write files to any location within the file system.	20 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper session management, allowing attackers to execute arbitrary code.	20 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Titan SFTP and Titan MFT NextGen server software lies in improper default permissions, allowing unauthorized access by attackers to protected information.	20 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper limitation of the path name for the restricted access directory. This allows a perpetrator to obtain an arbitrary file size from the file system.	20 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-45690	16 Oct 202320:32	–	circl
CNNVD	South River Technologies TitanFTP NextGen Security Vulnerability	16 Oct 202300:00	–	cnnvd
CNNVD	South River Technologies Titan MFT and Titan SFTP Path Traversal Vulnerabilities	16 Oct 202300:00	–	cnnvd
CNNVD	South River Technologies Titan MFT and Titan SFTP Authorization Issues Vulnerability	16 Oct 202300:00	–	cnnvd
CNNVD	South River Technologies Titan MFT and Titan SFTP Path Traversal Vulnerabilities	16 Oct 202300:00	–	cnnvd

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Titan MFT",
    "vendor": "South River Technologies",
    "versions": [
      {
        "lessThanOrEqual": "2.0.17.2298",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Titan SFTP",
    "vendor": "South River Technologies",
    "versions": [
      {
        "lessThanOrEqual": "2.0.17.2298",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
helpdesk	www.helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
rapid7	www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

16 Oct 2023 16:20Current

5.5Medium risk

Vulners AI Score5.5

EPSS0.0026

CWE-276