In WS_FTP Server versions prior to 8.7.4 and 8.8.2,
a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
References
| Link | Resource |
|---|---|
| https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 | Vendor Advisory |
| https://www.progress.com/ws_ftp | Product |
Configurations
Configuration 1 (hide)
|
History
27 Sep 2023, 19:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 - Vendor Advisory | |
| References | (MISC) https://www.progress.com/ws_ftp - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| CWE | CWE-89 | |
| First Time |
Progress
Progress ws Ftp Server |
|
| CPE | cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* |
27 Sep 2023, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. |
27 Sep 2023, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-27 15:18
Updated : 2023-12-10 15:14
NVD link : CVE-2023-40046
Mitre link : CVE-2023-40046
CVE.ORG link : CVE-2023-40046
JSON object : View
Products Affected
progress
- ws_ftp_server
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')