Vulnerability Intelligence Report
WS_FTP Server SQL Injection via Administrative Interface
CVE-2023-40046
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
No Active Exploit Signals
CVSS Base Score
8.2
HIGH
Exploitability:2.3
Impact Score:5.3
EPSS Probability:0.85%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-89 ↗CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Progress Software Corporation | WS_FTP Server | 8.8.0 < 8.8.2 (affected), 8.7.0 < 8.7.4 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.854%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Progress Software Corporation · Vendor · USA |
| Reserved | 2023-08-08T19:44:41 |
| Published | 2023-09-27T14:50:18 |
| Patch Date | 2023-09-27 |
| Last Updated | 2024-09-23T15:07:01 |
Community Chatter & Buzz