8.8Hoch
CVE-2020-37032Wing FTP Server 6.3.8 - Remote Code Execution
Beschreibung
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Schwachstellentyp (CWE):
CWE-78
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.3.8 | |
| Wing FTP Server | Wing FTP Server | 6.3.8 |
Referenzen und Patches
- ExploitDB-48676 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- VulnCheck Advisory: Wing FTP Server 6.3.8 - Remote Code Execution third-party-advisoryBroken Link
CPE-Treffer (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:6.3.8:*:*:*:*:*:*:*