Vulnerability Details : CVE-2023-42659
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.
Products affected by CVE-2023-42659
- cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-42659
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-42659
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
3.1
|
5.3
|
Progress Software Corporation |
CWE ids for CVE-2023-42659
-
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.Assigned by:
- nvd@nist.gov (Primary)
- security@progress.com (Secondary)
References for CVE-2023-42659
-
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023
Article DetailVendor Advisory
-
https://www.progress.com/ws_ftp
WS_FTP - Secure FTP Server and Client SoftwareProduct
Jump to