8.8Alta
CVE-2020-37032Wing FTP Server 6.3.8 - Remote Code Execution
Descripción
Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.3.8 | |
| Wing FTP Server | Wing FTP Server | 6.3.8 |
Referencias y parches
- ExploitDB-48676 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- VulnCheck Advisory: Wing FTP Server 6.3.8 - Remote Code Execution third-party-advisoryBroken Link
Coincidencias CPE (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:6.3.8:*:*:*:*:*:*:*