CVE Vulnerability

CVE-2020-9470

An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.

6.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.hooperlabs.xyz/disclosures/cve-2020-9470.php Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*
Information

Published : 2020-03-07 01:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-9470

Mitre link : CVE-2020-9470

Products Affected
No products.
CWE
CWE-732