8.8High
CVE-2020-37032Wing FTP Server 6.3.8 - Remote Code Execution
Description
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.3.8 | |
| Wing FTP Server | Wing FTP Server | 6.3.8 |
References and patches
- ExploitDB-48676 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- VulnCheck Advisory: Wing FTP Server 6.3.8 - Remote Code Execution third-party-advisoryBroken Link
CPE matches (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:6.3.8:*:*:*:*:*:*:*