5

CVE-2008-5692

Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ipswitch ≫ Ws Ftp Version <= 6.1
Ipswitch ≫ Ws Ftp Version1.0.5
Ipswitch ≫ Ws Ftp Version2.01
Ipswitch ≫ Ws Ftp Version2.02
Ipswitch ≫ Ws Ftp Version2.03
Ipswitch ≫ Ws Ftp Version3.0
Ipswitch ≫ Ws Ftp Version3.0.1
Ipswitch ≫ Ws Ftp Version3.1.0
Ipswitch ≫ Ws Ftp Version3.1.1
Ipswitch ≫ Ws Ftp Version3.1.2
Ipswitch ≫ Ws Ftp Version3.1.3
Ipswitch ≫ Ws Ftp Version3.14
Ipswitch ≫ Ws Ftp Version4.00
Ipswitch ≫ Ws Ftp Version4.01
Ipswitch ≫ Ws Ftp Version4.02
Ipswitch ≫ Ws Ftp Version5.00
Ipswitch ≫ Ws Ftp Version5.01
Ipswitch ≫ Ws Ftp Version5.02
Ipswitch ≫ Ws Ftp Version5.03
Ipswitch ≫ Ws Ftp Version5.04
Ipswitch ≫ Ws Ftp Version5.05
Ipswitch ≫ Ws Ftp Version6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.84% 0.939
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://aluigi.altervista.org/adv/wsftpweblog-adv.txt
http://docs.ipswitch.com/WS_FTP_Server611/ReleaseNotes/index.htm?k_id=ipswitch_ftp_documents_worldwide_ws_ftpserverv611releasenotes#link12
http://secunia.com/advisories/28822
http://securityreason.com/securityalert/4799
http://www.securityfocus.com/archive/1/487686/100/200/threaded
http://www.securityfocus.com/archive/1/487697/100/200/threaded
http://www.securityfocus.com/bid/27654
http://www.vupen.com/english/advisories/2008/0473