An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674.

Summary

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.

Timeline

1. Mar 13, 2019Public exploit on Exploit-DB

   EDB-46534

2. Mar 22, 2019, 7:02 PM UTCCVE published
3. Aug 4, 2024, 9:54 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 6