4.3Mittel
CVE-2020-37079Wing FTP Server < 6.2.7 - Cross-site Request Forgery
Beschreibung
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.
Schwachstellentyp (CWE):
CWE-352
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.2.6 | |
| Wing FTP Server | Wing FTP Server | 6.2.6 |
Referenzen und Patches
- ExploitDB-48200 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- Wing FTP Server Version History patchRelease Notes
- VulnCheck Advisory: Wing FTP Server < 6.2.7 - Cross-site Request Forgery third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*< 6.2.7