Path Traversal in Progress Ws FTP Server
CVE-2023-42657
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.170 (96.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Progress Ws_ftp_server
- Progress Software Corporation Ws_ftp Server — versions 8.8.0, 8.7.0
Weakness classification (CWE)
References
- security@progress.com (Product, product)
- security@progress.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-42657?
- CVE-2023-42657 is a critical-severity vulnerability in Progress Ws FTP Server, classified under Path Traversal. CVSS score: 9.9/10. Published 2023-09-27.
- How severe is CVE-2023-42657?
- Critical severity. CVSS v3 base score is 9.9 out of 10.