ws ftp server vulnerabilities and fixes

Recent CVEs affecting ws ftp server, with upgrade or downgrade steps. 17 tracked.

Also searched as: wsftpserver.

ws ftp server has 17 tracked vulnerabilities, 5 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 16. Most recent: 2024-08-28. Highest priority: CVE-2023-40044 (score 100/100).

• CVE-2024-7745 MEDIUM 6.5 UPGRADE In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of t
• CVE-2024-7744 MEDIUM 6.5 UPGRADE In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Direct
• CVE-2024-1474 HIGH 7.5 UPGRADE In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various
• CVE-2023-42659 CRITICAL 9.1 UPGRADE In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified
• CVE-2023-42657 CRITICAL 9.9 UPGRADE In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An
• CVE-2023-40049 MEDIUM 5.3 UPGRADE In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServ
• CVE-2023-40048 MEDIUM 6.8 UPGRADE In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site reque
• CVE-2023-40047 HIGH 8.3 UPGRADE In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP
• CVE-2023-40046 HIGH 8.2 UPGRADE In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Se
• CVE-2023-40045 HIGH 8.3 UPGRADE In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability
• CVE-2023-40044 CRITICAL 10.0 EXPLOITED UPGRADE Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
• CVE-2023-24029 HIGH 7.2 UPGRADE In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via
• CVE-2022-27665 MEDIUM 6.1 DOWNGRADE Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0
• CVE-2019-12146 CRITICAL 9.1 UPGRADE A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before
• CVE-2019-12145 HIGH 7.5 UPGRADE A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before
• CVE-2019-12144 CRITICAL 9.8 UPGRADE An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1
• CVE-2019-12143 MEDIUM 5.3 UPGRADE A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before

FAQ

How do I fix ws ftp server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ws ftp server being exploited right now?

Yes: 1 ws ftp server CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which ws ftp server CVE should I patch first?

CVE-2023-40044 currently ranks highest (100/100): Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability.

RSS feed for ws ftp server · ← Back to latest CVEs