What is CVE-2023-42659?

CVE-2023-42659 is a critical-severity vulnerability in Progress Ws_ftp_server, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.1/10. Published 2023-11-07.

How severe is CVE-2023-42659?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Arbitrary file upload in Progress Ws_ftp_server

CVE-2023-42659

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified locati…

Vulnerability class: Unrestricted File Upload

EPSS: 0.009 (55.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L.

Affected products

Progress Ws_ftp_server
Progress Software Corporation Ws_ftp Server — versions 8.8.0, 8.7.0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

security@progress.com (Product, product)
security@progress.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-42659?: CVE-2023-42659 is a critical-severity vulnerability in Progress Ws_ftp_server, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.1/10. Published 2023-11-07.
How severe is CVE-2023-42659?: Critical severity. CVSS v3 base score is 9.1 out of 10.