Ws Ftp Server
Monthly
Denial of service in Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4) allows unauthenticated remote attackers who know a valid account's enrolled SSH public key to terminate the shared SSH service, producing an availability-only impact rated CVSS 7.5. The independent assessment assigns high attack complexity because the enrolled public key is a concrete per-account prerequisite that must be discovered or obtained first, and confirms no confidentiality or integrity impact. No public exploit was identified at time of analysis and a vendor patch is available.
OS command injection in Progress WS_FTP Server on Windows lets authenticated low-privilege users execute arbitrary operating-system commands in deployments that match a configuration the advisory does not identify, with fixes in 2024.0.7 for the 2024 branch and 2025.0.4 for the 2025 branch. The 9.9 CVSS rating reflects network reachability, low-privilege authentication, and a scope change, but the configuration dependency and credential requirement narrow practical exposure; this is a genuine high-priority issue rather than an inflated-CVSS artifact. No public exploit is identified at time of analysis, and vendor patches are available; the issue is prioritized act_now.
Improper access control in the Web Admin console of Progress WS_FTP Server on Windows, in versions prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch, lets remote, unauthenticated callers reach administrative functionality, carrying a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H). The high attack complexity signals that a specific precondition must hold before exploitation succeeds, although the trigger itself is not described in the available sources. No public exploit has been identified at time of analysis, and vendor-released fixes are available for both branches.
Path traversal in Progress WS_FTP Server on Windows lets a delegated Host Administrator escape the scope they were granted and reach files and locations outside it, which the vendor states can potentially lead to remote code execution. Only installations prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch are affected, and exploitation requires the attacker to already hold a delegated Host Administrator account - anonymous or ordinary FTP users cannot reach the flaw, matching the PR:H metric in the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C vector with high confidentiality, integrity and availability impact. No public exploit code was identified at the time of analysis, and vendor-supplied patched builds resolve the condition.
OS command injection in Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and prior to 2025.0.4) allows a network-reaching attacker to run arbitrary operating-system commands, and the scope-changed vector indicates the execution can affect resources beyond the vulnerable service itself, consistent with the vendor's description of elevated privileges. Exploitation is not trivially reliable - the CVSS vector carries AC:H and the flaw is only reachable 'under certain configurations' that the vendor does not name in the available sources - but no authentication or user interaction is indicated once that configuration is present (PR:N, UI:N). No CISA KEV entry and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis; the vuln.today priority decision for this issue is act_now, driven by the 9.0 severity and the scope-changed, high-integrity/availability impact rather than by observed exploitation.
Path traversal in Progress Software WS_FTP Server on Windows allows an authenticated delegated Host Administrator to read or modify files outside the scope assigned to that role. Affected builds are the 2024 branch before 2024.0.7 and the 2025 branch before 2025.0.4; the vendor has released fixes for both. No public exploit has been identified at time of analysis, and the flaw requires a privileged sub-administrator account rather than anonymous or ordinary file-transfer access.
Privilege escalation in Progress WS_FTP Server on Windows lets an account holding the delegated Host Administrator role break out of its assigned scope through the administrative interface, reaching elevated privileges and potentially arbitrary command execution on the underlying server. Only Windows deployments on the 2024 branch before 2024.0.7 and the 2025 branch before 2025.0.4 are affected; patched builds remove the path. The gating precondition is strong - the attacker must already hold or have compromised a legitimate but scope-limited Host Administrator credential (CVSS PR:H), so this is not reachable by anonymous or unauthenticated actors. No public exploit has been identified at time of analysis, though the vendor-reported, network-reachable, scope-changing nature of the flaw and the act_now priority label make prompt patching warranted.
Progress WS_FTP Server on Windows exposes sensitive information, including administrative credentials, to unauthenticated remote attackers because of improper authentication in releases before 2024.0.6 and before 2025.0.3. The maximum CVSS score of 10.0 and the vuln.today act_now label reflect a network-reachable, no-prerequisites authentication bypass with changed scope and high confidentiality, integrity, and availability impact; patched releases are not vulnerable. No public exploit was identified at time of analysis, and the available sources do not confirm active exploitation.
Authenticated path traversal in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows lets a logged-in user read files outside their intended directories, rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact and no effect on integrity or availability. All 2024-branch releases prior to 2024.0.6 and 2025-branch releases prior to 2025.0.3 are affected, and the flaw requires a valid WS_FTP Server account plus active use of Ad Hoc Transfer, so an unauthenticated remote attacker cannot trigger it. No public exploit was identified at time of analysis; the vendor has released fixed versions.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in the Progress Software WS_FTP Server Manager web console allows an authenticated Manager administrator to execute arbitrary commands with the privileges of the IIS worker process on Windows deployments. Affected are versions prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch; fixed releases exist for both branches. Impact is constrained because the attacker must already hold the application's highest administrative role and code runs only at the worker-process privilege level rather than necessarily as SYSTEM, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Improper pathname restriction (CWE-22 path traversal) in Progress Software WS_FTP Server on Windows before 2024.0.7 and before 2025.0.4 lets a network-reachable, unauthenticated attacker write or alter files outside the intended directory, with only low integrity impact and no confidentiality or availability impact. The vendor-aligned CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the practical limits are the Windows-only exposure, the bounded file-manipulation primitive, and the need for the server to be reachable over the network. No public exploit is identified at time of analysis, and vendor fixes exist for both branches.
Progress Software WS_FTP Server can be driven into resource exhaustion and service degradation through its Ad Hoc Transfer component, which fails to release backend receiver sessions. The issue affects Windows deployments prior to 2024.0.7 and prior to 2025.0.4; the CVSS vector indicates remote, unauthenticated, no-interaction exploitation with only low availability impact and no confidentiality or integrity impact. Patch available from vendor, and no public exploit identified at time of analysis.
Improper authentication in the Web Transfer Module of Progress WS_FTP Server on Windows lets an attacker who already holds a valid account password read certain files associated with that account without satisfying configured multi-factor authentication. Only deployments prior to 2024.0.7 and 2025.0.4 are affected, the assessed vector is authenticated (PR:L) with limited confidentiality impact, and no public exploit has been identified at time of analysis. Vendor-released fixed versions are available and the issue is scoped for remediation this month.
Progress Software WS_FTP Server on Windows, in versions prior to 2024.0.7 and 2025.0.4, can expose another user's password in clear text to an administrator who already holds an account on the server. That administrator could then reuse the disclosed credentials to gain broader administrative access. The issue is rated CVSS 6.6 and is a moderate-severity privilege-boundary problem rather than a mass-exploitation emergency; no public exploit or active exploitation is identified in the provided intelligence, and vendor patches are available in 2024.0.7 and 2025.0.4.
Authenticated MFA bypass in Progress WS_FTP Server on Windows affects versions prior to 2024.0.6 and 2025.0.3. An attacker who already holds valid WS_FTP SSH credentials can exploit improper association of authentication factors between accounts to defeat MFA, with high confidentiality and integrity impact and no availability impact. No CISA KEV entry or public exploit code was identified at time of analysis, and the vendor has released fixed versions.
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4) allows unauthenticated remote attackers who know a valid account's enrolled SSH public key to terminate the shared SSH service, producing an availability-only impact rated CVSS 7.5. The independent assessment assigns high attack complexity because the enrolled public key is a concrete per-account prerequisite that must be discovered or obtained first, and confirms no confidentiality or integrity impact. No public exploit was identified at time of analysis and a vendor patch is available.
OS command injection in Progress WS_FTP Server on Windows lets authenticated low-privilege users execute arbitrary operating-system commands in deployments that match a configuration the advisory does not identify, with fixes in 2024.0.7 for the 2024 branch and 2025.0.4 for the 2025 branch. The 9.9 CVSS rating reflects network reachability, low-privilege authentication, and a scope change, but the configuration dependency and credential requirement narrow practical exposure; this is a genuine high-priority issue rather than an inflated-CVSS artifact. No public exploit is identified at time of analysis, and vendor patches are available; the issue is prioritized act_now.
Improper access control in the Web Admin console of Progress WS_FTP Server on Windows, in versions prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch, lets remote, unauthenticated callers reach administrative functionality, carrying a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H). The high attack complexity signals that a specific precondition must hold before exploitation succeeds, although the trigger itself is not described in the available sources. No public exploit has been identified at time of analysis, and vendor-released fixes are available for both branches.
Path traversal in Progress WS_FTP Server on Windows lets a delegated Host Administrator escape the scope they were granted and reach files and locations outside it, which the vendor states can potentially lead to remote code execution. Only installations prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch are affected, and exploitation requires the attacker to already hold a delegated Host Administrator account - anonymous or ordinary FTP users cannot reach the flaw, matching the PR:H metric in the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C vector with high confidentiality, integrity and availability impact. No public exploit code was identified at the time of analysis, and vendor-supplied patched builds resolve the condition.
OS command injection in Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and prior to 2025.0.4) allows a network-reaching attacker to run arbitrary operating-system commands, and the scope-changed vector indicates the execution can affect resources beyond the vulnerable service itself, consistent with the vendor's description of elevated privileges. Exploitation is not trivially reliable - the CVSS vector carries AC:H and the flaw is only reachable 'under certain configurations' that the vendor does not name in the available sources - but no authentication or user interaction is indicated once that configuration is present (PR:N, UI:N). No CISA KEV entry and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis; the vuln.today priority decision for this issue is act_now, driven by the 9.0 severity and the scope-changed, high-integrity/availability impact rather than by observed exploitation.
Path traversal in Progress Software WS_FTP Server on Windows allows an authenticated delegated Host Administrator to read or modify files outside the scope assigned to that role. Affected builds are the 2024 branch before 2024.0.7 and the 2025 branch before 2025.0.4; the vendor has released fixes for both. No public exploit has been identified at time of analysis, and the flaw requires a privileged sub-administrator account rather than anonymous or ordinary file-transfer access.
Privilege escalation in Progress WS_FTP Server on Windows lets an account holding the delegated Host Administrator role break out of its assigned scope through the administrative interface, reaching elevated privileges and potentially arbitrary command execution on the underlying server. Only Windows deployments on the 2024 branch before 2024.0.7 and the 2025 branch before 2025.0.4 are affected; patched builds remove the path. The gating precondition is strong - the attacker must already hold or have compromised a legitimate but scope-limited Host Administrator credential (CVSS PR:H), so this is not reachable by anonymous or unauthenticated actors. No public exploit has been identified at time of analysis, though the vendor-reported, network-reachable, scope-changing nature of the flaw and the act_now priority label make prompt patching warranted.
Progress WS_FTP Server on Windows exposes sensitive information, including administrative credentials, to unauthenticated remote attackers because of improper authentication in releases before 2024.0.6 and before 2025.0.3. The maximum CVSS score of 10.0 and the vuln.today act_now label reflect a network-reachable, no-prerequisites authentication bypass with changed scope and high confidentiality, integrity, and availability impact; patched releases are not vulnerable. No public exploit was identified at time of analysis, and the available sources do not confirm active exploitation.
Authenticated path traversal in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows lets a logged-in user read files outside their intended directories, rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact and no effect on integrity or availability. All 2024-branch releases prior to 2024.0.6 and 2025-branch releases prior to 2025.0.3 are affected, and the flaw requires a valid WS_FTP Server account plus active use of Ad Hoc Transfer, so an unauthenticated remote attacker cannot trigger it. No public exploit was identified at time of analysis; the vendor has released fixed versions.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in the Progress Software WS_FTP Server Manager web console allows an authenticated Manager administrator to execute arbitrary commands with the privileges of the IIS worker process on Windows deployments. Affected are versions prior to 2024.0.7 on the 2024 branch and prior to 2025.0.4 on the 2025 branch; fixed releases exist for both branches. Impact is constrained because the attacker must already hold the application's highest administrative role and code runs only at the worker-process privilege level rather than necessarily as SYSTEM, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Improper pathname restriction (CWE-22 path traversal) in Progress Software WS_FTP Server on Windows before 2024.0.7 and before 2025.0.4 lets a network-reachable, unauthenticated attacker write or alter files outside the intended directory, with only low integrity impact and no confidentiality or availability impact. The vendor-aligned CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the practical limits are the Windows-only exposure, the bounded file-manipulation primitive, and the need for the server to be reachable over the network. No public exploit is identified at time of analysis, and vendor fixes exist for both branches.
Progress Software WS_FTP Server can be driven into resource exhaustion and service degradation through its Ad Hoc Transfer component, which fails to release backend receiver sessions. The issue affects Windows deployments prior to 2024.0.7 and prior to 2025.0.4; the CVSS vector indicates remote, unauthenticated, no-interaction exploitation with only low availability impact and no confidentiality or integrity impact. Patch available from vendor, and no public exploit identified at time of analysis.
Improper authentication in the Web Transfer Module of Progress WS_FTP Server on Windows lets an attacker who already holds a valid account password read certain files associated with that account without satisfying configured multi-factor authentication. Only deployments prior to 2024.0.7 and 2025.0.4 are affected, the assessed vector is authenticated (PR:L) with limited confidentiality impact, and no public exploit has been identified at time of analysis. Vendor-released fixed versions are available and the issue is scoped for remediation this month.
Progress Software WS_FTP Server on Windows, in versions prior to 2024.0.7 and 2025.0.4, can expose another user's password in clear text to an administrator who already holds an account on the server. That administrator could then reuse the disclosed credentials to gain broader administrative access. The issue is rated CVSS 6.6 and is a moderate-severity privilege-boundary problem rather than a mass-exploitation emergency; no public exploit or active exploitation is identified in the provided intelligence, and vendor patches are available in 2024.0.7 and 2025.0.4.
Authenticated MFA bypass in Progress WS_FTP Server on Windows affects versions prior to 2024.0.6 and 2025.0.3. An attacker who already holds valid WS_FTP SSH credentials can exploit improper association of authentication factors between accounts to defeat MFA, with high confidentiality and integrity impact and no availability impact. No CISA KEV entry or public exploit code was identified at time of analysis, and the vendor has released fixed versions.
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.