CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 1CVE-2023-45685 – Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers
https://notcve.org/view.php?id=CVE-2023-45685
Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal La validación de ruta insuficiente al extraer un archivo zip en los servidores Titan MFT y Titan SFTP de South River Technologies en Windows y Linux permite a un atacante autenticado escribir un archivo en cualquier ubicación del sistema de archivos a través de un path traversal • https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690 https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-44215
https://notcve.org/view.php?id=CVE-2022-44215
There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL. Hay una vulnerabilidad de redirección abierta en las versiones 19.0 e inferiores del servidor Titan FTP. Los usuarios son redirigidos a cualquier URL de destino. • https://github.com/JBalanza/CVE-2022-44215 https://drive.google.com/file/d/1oLJaqs5RRNQLT1Hyy-tgEzzhGLB0506J/view?usp=sharing • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27744
https://notcve.org/view.php?id=CVE-2023-27744
An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution. • https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf https://www.whiteoaksecurity.com/blog/titanftp-vulnerability-disclosure •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27745
https://notcve.org/view.php?id=CVE-2023-27745
An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server. • https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf https://www.whiteoaksecurity.com/blog/titanftp-vulnerability-disclosure •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-22629 – TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2023-22629
An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem. Titan FTP server versions prior to 2.0.1.2102 suffer from a path traversal vulnerability. • https://www.exploit-db.com/exploits/51268 http://packetstormsecurity.com/files/171737/Titan-FTP-Path-Traversal.html https://f20.be/cves/titan-ftp-vulnerabilities https://titanftp.com https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •