What is CVE-2023-40046?

CVE-2023-40046 is a high-severity vulnerability in Progress Ws FTP Server, classified under SQL Injection. CVSS score: 8.2/10. Published 2023-09-27.

How severe is CVE-2023-40046?

High severity. CVSS v3 base score is 8.2 out of 10.

SQL Injection in Progress Ws FTP Server

CVE-2023-40046

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Vulnerability class: SQL Injection

EPSS: 0.009 (55.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L.

Affected products

Progress Ws_ftp_server
Progress Software Corporation Ws_ftp Server — versions 8.8.0, 8.7.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security@progress.com (Product, product)
security@progress.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-40046?: CVE-2023-40046 is a high-severity vulnerability in Progress Ws FTP Server, classified under SQL Injection. CVSS score: 8.2/10. Published 2023-09-27.
How severe is CVE-2023-40046?: High severity. CVSS v3 base score is 8.2 out of 10.