CVE-2014-1842

Nuclei

Titan FTP Server 10.32 Build 1816 - Directory Traversal

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2014-1842 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBTitan FTP Server 10.32 Build 1816 - Directory TraversalExploitDB exploitby Fara RusteinNot analyzed1 file

linked to 3 vulnerabilities

ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMTitan FTP Server Search Function < 10.40 - User EnumerationCVSS 5

Titan FTP Server versions prior to 10.40 build 1829 contain a directory traversal vulnerability in the web interface search functionality. Remote attackers can list all existing users by submitting "/../" in the search bar, enabling user enumeration and reconnaissance.

Impact

Unauthenticated attackers can exploit directory traversal in the web interface search functionality to enumerate all existing users, facilitating brute-force and targeted attacks against Titan FTP Server.

Remediation

Update Titan FTP Server to version 10.40 build 1829 or later that properly sanitizes search input and prevents directory traversal in the search bar.

WeaknessesCWE-22
Authorspussycat0x
Template tagscvecve2014networkftptitan-ftptcppassivevuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*
Shodan: product:"Titan ftpd"

Source: ProjectDiscovery

References

4