CVE-2023-42659

CRITICAL

Progress WS FTP Server < 8.7.6 - Unrestricted File Upload

Title source: rule

Description

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

References (2)

Core 2

Core References

Product product

https://www.progress.com/ws_ftp

Vendor Advisory vendor-advisory

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023

Scores

CVSS v3 9.1

EPSS 0.0004

EPSS Percentile 10.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-434

Status published

Products (1)

progress/ws_ftp_server < 8.7.6

Published Nov 07, 2023

Tracked Since Feb 18, 2026