CVE-2023-40045



In WS_FTP Server versions prior to 8.7.4 and 8.8.2,

 a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module.  An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.3 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
progressws_ftp_server
𝑥
< 8.7.4
progressws_ftp_server
8.8 ≤
𝑥
< 8.8.2
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
progressws_ftp_server
8.8.0 ≤
𝑥
< 8.8.2
ADP
progressws_ftp_server
8.7.0 ≤
𝑥
< 8.7.4
ADP
Common Weakness Enumeration
References
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
https://www.progress.com/ws_ftp
https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
https://www.progress.com/ws_ftp