4.3Media
CVE-2020-37079Wing FTP Server < 6.2.7 - Cross-site Request Forgery
Descripción
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.
Debilidad (CWE):
CWE-352
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| wftpserver | wing ftp server | 6.2.6 | |
| Wing FTP Server | Wing FTP Server | 6.2.6 |
Referencias y parches
- ExploitDB-48200 exploitExploitThird Party AdvisoryVDB Entry
- Wing FTP Server Official Homepage productProduct
- Wing FTP Server Version History patchRelease Notes
- VulnCheck Advisory: Wing FTP Server < 6.2.7 - Cross-site Request Forgery third-party-advisoryThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*< 6.2.7