CVE-2023-40046
WS_FTP Server SQL Injection via Administrative Interface
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
In WS_FTP Server versions prior to 8.7.4 and 8.8.2,
a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
En las versiones del servidor WS_FTP anteriores a 8.7.4 y 8.8.2, existe una vulnerabilidad de inyección SQL en la interfaz del administrador del servidor WS_FTP. Un atacante puede inferir información sobre la estructura y el contenido de la base de datos, y ejecutar declaraciones SQL que alteren o eliminen elementos de la base de datos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-08-08 CVE Reserved
- 2023-09-27 CVE Published
- 2024-09-23 CVE Updated
- 2024-10-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
- CAPEC-66: SQL Injection
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.progress.com/ws_ftp | Product |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 | 2023-09-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Progress Search vendor "Progress" | Ws Ftp Server Search vendor "Progress" for product "Ws Ftp Server" | < 8.7.4 Search vendor "Progress" for product "Ws Ftp Server" and version " < 8.7.4" | - |
Affected
| ||||||
| Progress Search vendor "Progress" | Ws Ftp Server Search vendor "Progress" for product "Ws Ftp Server" | >= 8.8 < 8.8.2 Search vendor "Progress" for product "Ws Ftp Server" and version " >= 8.8 < 8.8.2" | - |
Affected
| ||||||