CVE-2024-9999

MEDIUM

WS_FTP Server < 8.8.9 - Incorrect Implementation of Authentication Algorithm in Web Transfer Module

Title source: llm

Description

In WS_FTP Server versions before 8.8.9 (2022.0.9), an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.

References (2)

Core 2

Core References

Various Sources vendor-advisory

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2024

Various Sources product

https://www.progress.com/ftp-server

Scores

CVSS v3 6.5

EPSS 0.0041

EPSS Percentile 32.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-303

Status published

Products (2)

Progress Software Corporation/WS_FTP Server < 8.8.9

Progress Software Corporation/WS_FTP Server 9.0.*

Published Nov 12, 2024

Tracked Since Feb 18, 2026