10

CVE-2023-40044

Warning
Media report
Exploit

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

Data is provided by the National Vulnerability Database (NVD)
Progress ≫ Ws Ftp Server Version < 8.7.4
Progress ≫ Ws Ftp Server Version >= 8.8 < 8.8.2

05.10.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

Vulnerability

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.43% 1
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@progress.com 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.theregister.com/2023/10/02/ws_ftp_update/
Third Party Advisory
Press/Media Coverage