4.3Medium
CVE-2020-37079Wing FTP Server < 6.2.7 - Cross-site Request Forgery
Description
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.
Weakness (CWE):
CWE-352
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.2.6 | |
| Wing FTP Server | Wing FTP Server | 6.2.6 |
References and patches
- ExploitDB-48200 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- Wing FTP Server Version History patchRelease Notes
- VulnCheck Advisory: Wing FTP Server < 6.2.7 - Cross-site Request Forgery third-party-advisoryThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*< 6.2.7