cvelistv5 - cve-2024-7744

CVE-2024-7744 (GCVE-0-2024-7744)

Vulnerability from cvelistv5 – Published: 2024-08-28 16:30 – Updated: 2024-08-28 17:50

Summary

In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal. An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

ProgressSoftware

References

URL

Tags

	https://community.progress.com/s/article/WS-FTP-S…	vendor-advisory
	https://www.progress.com/ftp-server	product

Impacted products

	Vendor	Product	Version
	Progress Software Corporation	WS_FTP Server	Affected: 0 , < 8.8.8 (semver)

Credits

https://www.zerodayinitiative.com/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:progress:ws_ftp_server:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws_ftp_server",
            "vendor": "progress",
            "versions": [
              {
                "lessThan": "8.8.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-28T17:49:12.375525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T17:50:10.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Transfer Module"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "WS_FTP Server",
          "vendor": "Progress Software Corporation",
          "versions": [
            {
              "lessThan": "8.8.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://www.zerodayinitiative.com/"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\u003cbr\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003eAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is \u003cb\u003eC:\u003c/b\u003e)\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\n\u00a0\n\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-497",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-497 File Discovery"
            }
          ]
        },
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        },
        {
          "capecId": "CAPEC-73",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-73 User-Controlled Filename"
            }
          ]
        },
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-28T16:30:14.787Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.progress.com/ftp-server"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in Progress WS_FTP Server",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2024-7744",
    "datePublished": "2024-08-28T16:30:14.787Z",
    "dateReserved": "2024-08-13T14:28:44.247Z",
    "dateUpdated": "2024-08-28T17:50:10.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.8.8\", \"matchCriteriaId\": \"4C8672E4-5F87-4A71-93F9-914643F56F4F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\\n\\u00a0\\n\\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)\"}, {\"lang\": \"es\", \"value\": \"En las versiones de WS_FTP Server anteriores a la 8.8.8 (2022.0.8), una vulnerabilidad de limitaci\\u00f3n incorrecta de una ruta de acceso a un directorio restringido (\\\"Path Traversal\\\") en el m\\u00f3dulo de transferencia web permite el descubrimiento de archivos, el sondeo de archivos del sistema, el nombre de archivo controlado por el usuario y Path Traversal. Se ha identificado una falla de descarga de archivos autenticados en la que un usuario puede crear una llamada API que le permite descargar un archivo desde una carpeta arbitraria en la unidad donde se encuentra la carpeta ra\\u00edz del host de ese usuario (de manera predeterminada, es C:)\"}]",
      "id": "CVE-2024-7744",
      "lastModified": "2024-09-04T17:57:51.657",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@progress.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-28T17:15:11.380",
      "references": "[{\"url\": \"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024\", \"source\": \"security@progress.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.progress.com/ftp-server\", \"source\": \"security@progress.com\", \"tags\": [\"Product\"]}]",
      "sourceIdentifier": "security@progress.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"security@progress.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}, {\"lang\": \"en\", \"value\": \"CWE-73\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-7744\",\"sourceIdentifier\":\"security@progress.com\",\"published\":\"2024-08-28T17:15:11.380\",\"lastModified\":\"2024-09-04T17:57:51.657\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\\n\u00a0\\n\\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)\"},{\"lang\":\"es\",\"value\":\"En las versiones de WS_FTP Server anteriores a la 8.8.8 (2022.0.8), una vulnerabilidad de limitaci\u00f3n incorrecta de una ruta de acceso a un directorio restringido (\\\"Path Traversal\\\") en el m\u00f3dulo de transferencia web permite el descubrimiento de archivos, el sondeo de archivos del sistema, el nombre de archivo controlado por el usuario y Path Traversal. Se ha identificado una falla de descarga de archivos autenticados en la que un usuario puede crear una llamada API que le permite descargar un archivo desde una carpeta arbitraria en la unidad donde se encuentra la carpeta ra\u00edz del host de ese usuario (de manera predeterminada, es C:)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@progress.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@progress.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-73\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.8.8\",\"matchCriteriaId\":\"4C8672E4-5F87-4A71-93F9-914643F56F4F\"}]}]}],\"references\":[{\"url\":\"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024\",\"source\":\"security@progress.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.progress.com/ftp-server\",\"source\":\"security@progress.com\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-7744\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T17:49:12.375525Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:progress:ws_ftp_server:-:*:*:*:*:*:*:*\"], \"vendor\": \"progress\", \"product\": \"ws_ftp_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.8.8\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T17:50:00.436Z\"}}], \"cna\": {\"title\": \"Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in Progress WS_FTP Server\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"https://www.zerodayinitiative.com/\"}], \"impacts\": [{\"capecId\": \"CAPEC-497\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-497 File Discovery\"}]}, {\"capecId\": \"CAPEC-639\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-639 Probe System Files\"}]}, {\"capecId\": \"CAPEC-73\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-73 User-Controlled Filename\"}]}, {\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126 Path Traversal\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Progress Software Corporation\", \"modules\": [\"Web Transfer Module\"], \"product\": \"WS_FTP Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.8.8\", \"versionType\": \"semver\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.progress.com/ftp-server\", \"tags\": [\"product\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\\n\\u00a0\\n\\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\u003cbr\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003eAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is \u003cb\u003eC:\u003c/b\u003e)\u003cbr\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"CWE-73 External Control of File Name or Path\"}]}], \"providerMetadata\": {\"orgId\": \"f9fea0b6-671e-4eea-8fde-31911902ae05\", \"shortName\": \"ProgressSoftware\", \"dateUpdated\": \"2024-08-28T16:30:14.787Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-7744\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-28T17:50:10.933Z\", \"dateReserved\": \"2024-08-13T14:28:44.247Z\", \"assignerOrgId\": \"f9fea0b6-671e-4eea-8fde-31911902ae05\", \"datePublished\": \"2024-08-28T16:30:14.787Z\", \"assignerShortName\": \"ProgressSoftware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-M9CP-9VC4-2WPG

Vulnerability from github – Published: 2024-08-28 18:31 – Updated: 2024-09-04 18:30

Details

An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:)

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-7744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-28T17:15:11Z",
    "severity": "MODERATE"
  },
  "details": "In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\n\u00a0\n\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)",
  "id": "GHSA-m9cp-9vc4-2wpg",
  "modified": "2024-09-04T18:30:49Z",
  "published": "2024-08-28T18:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7744"
    },
    {
      "type": "WEB",
      "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024"
    },
    {
      "type": "WEB",
      "url": "https://www.progress.com/ftp-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2024-7744

Vulnerability from fkie_nvd - Published: 2024-08-28 17:15 - Updated: 2024-09-04 17:57

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@progress.com	https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024	Vendor Advisory
	security@progress.com	https://www.progress.com/ftp-server	Product

Impacted products

	Vendor	Product	Version
	progress	ws_ftp_server	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C8672E4-5F87-4A71-93F9-914643F56F4F",
              "versionEndExcluding": "8.8.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.\n\u00a0\n\nAn authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host\u0027s root folder is located (by default this is C:)"
    },
    {
      "lang": "es",
      "value": "En las versiones de WS_FTP Server anteriores a la 8.8.8 (2022.0.8), una vulnerabilidad de limitaci\u00f3n incorrecta de una ruta de acceso a un directorio restringido (\"Path Traversal\") en el m\u00f3dulo de transferencia web permite el descubrimiento de archivos, el sondeo de archivos del sistema, el nombre de archivo controlado por el usuario y Path Traversal. Se ha identificado una falla de descarga de archivos autenticados en la que un usuario puede crear una llamada API que le permite descargar un archivo desde una carpeta arbitraria en la unidad donde se encuentra la carpeta ra\u00edz del host de ese usuario (de manera predeterminada, es C:)"
    }
  ],
  "id": "CVE-2024-7744",
  "lastModified": "2024-09-04T17:57:51.657",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "security@progress.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-08-28T17:15:11.380",
  "references": [
    {
      "source": "security@progress.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024"
    },
    {
      "source": "security@progress.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.progress.com/ftp-server"
    }
  ],
  "sourceIdentifier": "security@progress.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security@progress.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

WID-SEC-W-2024-1948

Vulnerability from csaf_certbund - Published: 2024-08-28 22:00 - Updated: 2024-08-28 22:00

Summary

Progress Software WS_FTP: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

WS_FTP ist eine FTP (File Transfer Protocol) Software, die zur Übertragung von Dateien zwischen einem Client und einem Server über das Internet verwendet wird.

Angriff

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Progress Software WS_FTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "WS_FTP ist eine FTP (File Transfer Protocol) Software, die zur \u00dcbertragung von Dateien zwischen einem Client und einem Server \u00fcber das Internet verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Progress Software WS_FTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1948 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1948.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1948 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1948"
      },
      {
        "category": "external",
        "summary": "WS_FTP Server Service Pack (August 2024) vom 2024-08-28",
        "url": "https://community.progress.com/s/article/ka7Pb000000AvGLIA0"
      }
    ],
    "source_lang": "en-US",
    "title": "Progress Software WS_FTP: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-08-28T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-29T09:09:45.480+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-1948",
      "initial_release_date": "2024-08-28T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-28T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Server \u003c2022.0.8",
                "product": {
                  "name": "Progress Software WS_FTP Server \u003c2022.0.8",
                  "product_id": "T037168"
                }
              },
              {
                "category": "product_version",
                "name": "Server 2022.0.8",
                "product": {
                  "name": "Progress Software WS_FTP Server 2022.0.8",
                  "product_id": "T037168-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:progress:ws_ftp:server__2022.0.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "WS_FTP"
          }
        ],
        "category": "vendor",
        "name": "Progress Software"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7744",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Progress Software WS_FTP. Diese Fehler existieren im Web-Transfer-Modul aufgrund eines Path-Traversal-Problems und eines fehlenden kritischen Schritts im MFA-Prozess, der es erm\u00f6glicht, eine Datei aus einem beliebigen Ordner herunterzuladen oder die Pr\u00fcfung des zweiten Faktors zu \u00fcberspringen und sich nur mit Benutzername und Passwort anzumelden. Ein entfernter authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um die Multi-Faktor-Authentifizierung zu umgehen oder vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037168"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-7744"
    },
    {
      "cve": "CVE-2024-7745",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Progress Software WS_FTP. Diese Fehler existieren im Web-Transfer-Modul aufgrund eines Path-Traversal-Problems und eines fehlenden kritischen Schritts im MFA-Prozess, der es erm\u00f6glicht, eine Datei aus einem beliebigen Ordner herunterzuladen oder die Pr\u00fcfung des zweiten Faktors zu \u00fcberspringen und sich nur mit Benutzername und Passwort anzumelden. Ein entfernter authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um die Multi-Faktor-Authentifizierung zu umgehen oder vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037168"
        ]
      },
      "release_date": "2024-08-28T22:00:00.000+00:00",
      "title": "CVE-2024-7745"
    }
  ]
}

NCSC-2024-0354

Vulnerability from csaf_ncscnl - Published: 2024-08-30 13:42 - Updated: 2024-08-30 13:42

Summary

Kwetsbaarheden verholpen in Progress WS_FTP server

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Progress heeft kwetsbaarheden verholpen in WS_FTP server.

Interpretaties

Een kwaadwillende kan de kwetsbaarheden misbruiken om twee-factor-authenticatie te omzeilen, waarmee deze kan inloggen met slechts username en wachtwoord. Ook kan de kwaadwillende middels directory-traversal mogelijk toegang krijgen tot bestanden waartoe de kwaadwillende aanvankelijk niet is geautoriseerd.

Oplossingen

Progress heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-290

Authentication Bypass by Spoofing

CWE-304

Missing Critical Step in Authentication

CWE-73

External Control of File Name or Path

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Progress heeft kwetsbaarheden verholpen in WS_FTP server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om twee-factor-authenticatie te omzeilen, waarmee deze kan inloggen met slechts username en wachtwoord. Ook kan de kwaadwillende middels directory-traversal mogelijk toegang krijgen tot bestanden waartoe de kwaadwillende aanvankelijk niet is geautoriseerd.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Progress heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Authentication Bypass by Spoofing",
        "title": "CWE-290"
      },
      {
        "category": "general",
        "text": "Missing Critical Step in Authentication",
        "title": "CWE-304"
      },
      {
        "category": "general",
        "text": "External Control of File Name or Path",
        "title": "CWE-73"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd",
        "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Progress WS_FTP server",
    "tracking": {
      "current_release_date": "2024-08-30T13:42:50.517100Z",
      "id": "NCSC-2024-0354",
      "initial_release_date": "2024-08-30T13:42:50.517100Z",
      "revision_history": [
        {
          "date": "2024-08-30T13:42:50.517100Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "ws_ftp_server",
            "product": {
              "name": "ws_ftp_server",
              "product_id": "CSAFPID-1626981",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:progress_software_corporation:ws_ftp_server:0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "progress_software_corporation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7744",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "External Control of File Name or Path",
          "title": "CWE-73"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1626981"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-7744",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-7744.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1626981"
          ]
        }
      ],
      "title": "CVE-2024-7744"
    },
    {
      "cve": "CVE-2024-7745",
      "cwe": {
        "id": "CWE-304",
        "name": "Missing Critical Step in Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Critical Step in Authentication",
          "title": "CWE-304"
        },
        {
          "category": "other",
          "text": "Authentication Bypass by Spoofing",
          "title": "CWE-290"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1626981"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-7745",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-7745.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1626981"
          ]
        }
      ],
      "title": "CVE-2024-7745"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-7744 (GCVE-0-2024-7744)

GHSA-M9CP-9VC4-2WPG

FKIE_CVE-2024-7744

WID-SEC-W-2024-1948

NCSC-2024-0354

Tags

Sightings

Nomenclature