Vulnerabilities > CVE-2020-8634 - Improper Preservation of Permissions vulnerability in Wftpserver Wing FTP Server 6.2.3

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
wftpserver
CWE-281
NVD
Published: 2020-03-07
Updated: 2020-03-09

Summary

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.

Vulnerable Configurations

Part Description Count
Application
Wftpserver
3

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/156591/wingftpserver623-escalate.txt
idPACKETSTORM:156591
last seen2020-03-02
published2020-03-02
reporterCary Hooper
sourcehttps://packetstormsecurity.com/files/156591/Wing-FTP-Server-6.2.3-Privilege-Escalation.html
titleWing FTP Server 6.2.3 Privilege Escalation

References