Progress · WS_FTP Server
CVE-2023-40044
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
Nedir
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
CISA: Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 26 Ekim 2023
- CISA listesine eklenme
- 5 Ekim 2023
- Yayımlanma
- 27 Eylül 2023
- Önem
- Kritik 10,0 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 90% bilinen tüm açıkların en üstteki 0,2% diliminde
- Zayıflık
- CWE-502
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (8)
- https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
- https://www.progress.com/ws_ftp
- https://www.theregister.com/2023/10/02/ws_ftp_update/
- https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/
- https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044
- https://censys.com/cve-2023-40044/
- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
- http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.ht…
Progress için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 7 Ağu 2026 | Command Injection | LoadMaster | Kritik 9,6 | 99,8% |
| 3 Mar 2025 | Path Traversal | WhatsUp Gold | Kritik 9,8 | 99,3% |
| 18 Kas 2024 | OS Command Injection | Kemp LoadMaster | Kritik 10,0 | 95% |
| 16 Eyl 2024 | SQL Injection | WhatsUp Gold | Kritik 9,8 | 93% |
| 13 Haz 2024 | Authentication Bypass by Spoofing | Telerik Report Server | Kritik 9,8 | 97% |
| 2 Haz 2023 | SQL Injection | MOVEit Transfer | Kritik 9,8 | 99,9% |
| 3 Kas 2021 | Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness | ASP.NET AJAX and Sitefinity | Kritik 9,8 | 75% |
| 3 Kas 2021 | Deserialization of Untrusted Data | Telerik UI for ASP.NET AJAX | Kritik 9,8 | 99,7% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.