Path Traversal in Progress Ws FTP Server
CVE-2024-7744
In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal. An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.007 (50.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@progress.com (vendor-advisory, Vendor Advisory)
- security@progress.com (Product, product)
Frequently asked questions
- What is CVE-2024-7744?
- CVE-2024-7744 is a medium-severity vulnerability in Progress Ws FTP Server, classified under Path Traversal. CVSS score: 6.5/10. Published 2024-08-28.
- How severe is CVE-2024-7744?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-7744 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.