Privilege Escalation via Missing Authorization in WS_FTP Manager
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2024.0.7, 2025.0.4
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is Progress Software's WS_FTP Server on Windows, specifically its administrative interface. A delegated Host Administrator could exceed their permitted access and potentially run commands with elevated privileges, which could lead to full control of the underlying server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Affected versions
- Progress Software WS_FTP Server
fixed in 2024.0.7; fixed in 2025.0.4