QwikSec

Security Database

CVE

CWE

Training

CVE-2019-9648

Published: Mar 22, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_BID

http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509

x_refsource_CONFIRM

exploit

x_refsource_EXPLOIT-DB

20190311 CVE-2019-9648 CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal

mailing-list

x_refsource_FULLDISC

20190825 CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal (Metasploit) Exploit

mailing-list

x_refsource_FULLDISC

http://packetstormsecurity.com/files/154204/CoreFTP-Server-SIZE-Directory-Traversal.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.