WS_FTP Server vulnerabilities
19 known vulnerabilities in WS_FTP Server from Progress Software. 19 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
- 7.1 High severity
WS_FTP Server: Cleartext Storage of Sensitive Information
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
- 7.5 High severity
WS_FTP Server: Allocation of Resources Without Limits or Throttling
Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.
- 8.1 High severity
WS_FTP Server: Cleartext Transmission of Sensitive Information
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
- 7.5 High severity
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared…
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- 9.9 Critical severity
WS_FTP Server: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
- 8.1 High severity
WS_FTP Server: Improper Access Control
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
- 9.1 Critical severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- 9.0 Critical severity
WS_FTP Server: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
- 9.1 Critical severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- 9.1 Critical severity
WS_FTP Server: Missing Authorization
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exec
- 10.0 Critical severity
WS_FTP Server: Improper Authentication
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
- 7.7 High severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
- 8.1 High severity
WS_FTP Server: Improper Authentication
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.
- 8.8 High severity
WS_FTP Server: Unrestricted Upload of File with Dangerous Type
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying op
- 9.6 Critical severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_
- 7.2 High severity
WS_FTP Server: Improper Neutralization of Special Elements used in an SQL Command
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter
- 8.8 High severity
Progress WS_FTP Server Deserialization of Untrusted Data Exploited
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- 7.2 High severity
Ws FTP Server: Incorrect Authorization
In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows.