Local Privilege Escalation Vulnerability in Wing FTP Server by Wing FTP Server Limited
CVE-2020-8635

7.8HIGH

Key Information:

Vendor

Wftpserver

Status
Wing Ftp Server
Vendor
CVE Published:
7 March 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-8635?

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris has an issue where insecure permissions are applied to installation directories and configuration files. This misconfiguration permits local users to create FTP accounts with full privileges, leading to potential privilege escalation attacks by allowing unauthorized modifications to system files.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-8635
Created by Al1ex

References

https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.