Path Traversal in Progress Ws FTP Server
CVE-2023-42657
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.160 (96.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.170 · newest: 0.160 · change: -0.010
Affected products
- Progress Ws FTP Server
- Progress Software Corporation Ws FTP Server — versions 8.8.0, 8.7.0
Weakness classification (CWE)
References
- www.progress.com/ws_ftp (Product, product)
- community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-42657?
- CVE-2023-42657 is a critical-severity vulnerability in Progress Ws FTP Server, classified under Path Traversal. CVSS score: 9.9/10. Published 2023-09-27.
- How severe is CVE-2023-42657?
- Critical severity. CVSS v3 base score is 9.9 out of 10.