CVE-2024-1474 - Vulnerability Details - OpenCVE

In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Progress	Ws Ftp Server

Configuration 1 [-]

cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024
https://www.progress.com/ws_ftp

History

Thu, 02 Jan 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Progress Progress ws Ftp Server
CPEs		cpe:2.3:a:progress:ws_ftp_server::::::::
Vendors & Products		Progress Progress ws Ftp Server

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2024-02-21T15:33:20.265Z

Updated: 2024-08-01T18:40:21.196Z

Reserved: 2024-02-13T16:55:31.743Z

Link: CVE-2024-1474

Vulnrichment

Updated: 2024-08-01T18:40:21.196Z

NVD

Status : Analyzed

Published: 2024-02-21T16:15:49.520

Modified: 2025-01-02T13:58:35.287

Link: CVE-2024-1474

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1474", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2024-02-13T16:55:31.743Z", "datePublished": "2024-02-21T15:33:20.265Z", "dateUpdated": "2024-08-01T18:40:21.196Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Server Manager"], "product": "WS_FTP Server", "vendor": "Progress Software Coproration", "versions": [{"lessThan": "8.8.5", "status": "affected", "version": "8.8.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - mert"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - isira_adithya"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface."}], "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T15:33:20.265Z"}, "references": [{"tags": ["product"], "url": "https://www.progress.com/ws_ftp"}, {"tags": ["vendor-advisory"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T18:57:30.477426Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:51.778Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:40:21.196Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://www.progress.com/ws_ftp"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.progress.com/ws_ftp", "tags": ["product", "x_transferred"]}, {"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:40:21.196Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T18:57:30.477426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.348Z"}}], "cna": {"title": "WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - mert"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "BugCrowd - isira_adithya"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software Coproration", "modules": ["Server Manager"], "product": "WS_FTP Server", "versions": [{"status": "affected", "version": "8.8.0", "lessThan": "8.8.5", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.progress.com/ws_ftp", "tags": ["product"]}, {"url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.", "supportingMedia": [{"type": "text/html", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-02-21T15:33:20.265Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1474", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:40:21.196Z", "dateReserved": "2024-02-13T16:55:31.743Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2024-02-21T15:33:20.265Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "241FA960-1614-496D-AFF7-B15E556E7043", "versionEndExcluding": "8.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface."}, {"lang": "es", "value": "En las versiones del servidor WS_FTP anteriores a la 8.8.5, se identificaron problemas de Cross-Site Scripting Reflejado en varias entradas proporcionadas por el usuario en la interfaz administrativa del servidor WS_FTP."}], "id": "CVE-2024-1474", "lastModified": "2025-01-02T13:58:35.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@progress.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-21T16:15:49.520", "references": [{"source": "security@progress.com", "tags": ["Vendor Advisory"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}, {"source": "security@progress.com", "tags": ["Product"], "url": "https://www.progress.com/ws_ftp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.progress.com/ws_ftp"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@progress.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}