CVE-2024-1474 - OpenCVE

In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024
https://www.progress.com/ws_ftp

History

No history.

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2024-02-21T15:33:20.265Z

Updated: 2024-08-01T18:40:21.196Z

Reserved: 2024-02-13T16:55:31.743Z

Link: CVE-2024-1474

Vulnrichment

Updated: 2024-08-01T18:40:21.196Z

NVD

Status : Awaiting Analysis

Published: 2024-02-21T16:15:49.520

Modified: 2024-02-22T19:07:27.197

Link: CVE-2024-1474

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1474", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2024-02-13T16:55:31.743Z", "datePublished": "2024-02-21T15:33:20.265Z", "dateUpdated": "2024-08-01T18:40:21.196Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Server Manager"], "product": "WS_FTP Server", "vendor": "Progress Software Coproration", "versions": [{"lessThan": "8.8.5", "status": "affected", "version": "8.8.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - mert"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - isira_adithya"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface."}], "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T15:33:20.265Z"}, "references": [{"tags": ["product"], "url": "https://www.progress.com/ws_ftp"}, {"tags": ["vendor-advisory"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T18:57:30.477426Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:51.778Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:40:21.196Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://www.progress.com/ws_ftp"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.progress.com/ws_ftp", "tags": ["product", "x_transferred"]}, {"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:40:21.196Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T18:57:30.477426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.348Z"}}], "cna": {"title": "WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - mert"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - isira_adithya"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software Coproration", "modules": ["Server Manager"], "product": "WS_FTP Server", "versions": [{"status": "affected", "version": "8.8.0", "lessThan": "8.8.5", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.progress.com/ws_ftp", "tags": ["product"]}, {"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.", "supportingMedia": [{"type": "text/html", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T15:33:20.265Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1474", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:40:21.196Z", "dateReserved": "2024-02-13T16:55:31.743Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2024-02-21T15:33:20.265Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}