Weak Access Control between Domains in Wing FTP Server <= 7.2.0
CVE-2023-37881

8.8HIGH

Key Information:

Vendor

Wing FTP Server

Status
Wing FTP Server
Vendor
CVE Published:
12 September 2023

What is CVE-2023-37881?

A weak access control vulnerability in the Admin Web Client of Wing FTP Server allows unauthorized users to escalate privileges. This security flaw affects versions of the server up to 7.2.0, enabling attackers to gain unauthorized access and potentially control sensitive functionalities within the server environment. Organizations using vulnerable versions are advised to apply necessary patches and review their security policies to mitigate risks.

Affected Version(s)

Wing FTP Server <= 7.2.0

References

https://www.wftpserver.com/serverhistory.htm

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thomas Felder
.