WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
CVE-2023-40045

8.3HIGH

Key Information:

Vendor

Progress Software
Status
Ws Ftp Server
Vendor
CVE Published:
27 September 2023

What is CVE-2023-40045?

A reflected cross-site scripting (XSS) vulnerability has been identified in WS_FTP Server's Ad Hoc Transfer module for versions before 8.7.4 and 8.8.2. This vulnerability allows attackers to execute malicious JavaScript code in the browser of users interacting with the affected module. By crafting a specific payload, an attacker can exploit this flaw, potentially compromising user data or leading to further attacks. Users are advised to update their WS_FTP Server to the latest versions to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WS_FTP Server 8.8.0

WS_FTP Server 8.8.0 < 8.8.2

WS_FTP Server 8.7.0 < 8.7.4

References

https://www.progress.com/ws_ftp
product
https://community.progress.com/s/article/WS-FTP-Server-Cr...
vendor-advisory

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cristian Mocanu - Deloitte
JSON
.