CVE-2023-42659

CRITICAL

WS_FTP Server < 8.7.6 and 8.8.4 - Authenticated Unrestricted File Upload via API Call

Title source: llm

Description

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

References (2)

Core 2

Core References

Product product

https://www.progress.com/ws_ftp

Vendor Advisory vendor-advisory

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023

Scores

CVSS v3 9.1

EPSS 0.0090

EPSS Percentile 55.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-434

Status published

Products (1)

progress/ws_ftp_server < 8.7.6

Published Nov 07, 2023

Tracked Since Feb 18, 2026