6.8
CVE-2023-40048
- EPSS 0.35%
- Veröffentlicht 27.09.2023 15:19:00
- Zuletzt bearbeitet 21.11.2024 08:18:35
- Quelle security@progress.com
- CVE-Watchlists
- Unerledigt
LoginWS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Progress ≫ Ws Ftp Server Version < 8.8.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.35% | 0.268 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| security@progress.com | 6.8 | 1.6 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
https://www.progress.com/ws_ftp
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023