CVE-2020-27735

MEDIUMNuclei

Wing FTP 6.4.4 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-27735 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWing FTP 6.4.4 - Cross-Site ScriptingCVSS 6.1

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version of Wing FTP server or apply the vendor-provided patch to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020xsswing-ftpwftpservervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wftpserver:wing_ftp_server:6.4.4:*:*:*:*:*:*:*
https://www.wftpserver.com/serverhistory.htm https://wshenk.blogspot.com/2021/01/xss-in-wing-ftps-web-interface-cve-2020.html https://nvd.nist.gov/vuln/detail/CVE-2020-27735 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3