CVE-2023-40047
Assigner: ProgressSoftware
Published: 2023-09-27T14:50:55.329Z
State: PUBLISHED
affected: defaultStatus: affected
modules: Server Manager
product: WS_FTP Server
vendor: Progress Software Corporation
versions: lessThan: 8.8.2
status: affected
version: 8.8.0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Cristian Mocanu - Deloitte
datePublic: 2023-09-27T14:50:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>

<span style="background-color: rgb(255, 255, 255);">In WS_FTP Server version prior to 8.8.2,&nbsp;</span>a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module.  An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads.&nbsp; Once the cross-site scripting payload is successfully stored,&nbsp;&nbsp;an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.

</p>


value: 


In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module.  An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads.  Once the cross-site scripting payload is successfully stored,  an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.






impacts: capecId: CAPEC-63
descriptions: value: CAPEC-63 Cross-Site Scripting (XSS)
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
source: discovery: UNKNOWN
title: WS_FTP Server Stored Cross-Site Scripting Vulnerability
x_generator: engine: Vulnogram 0.1.0-dev