Read the docs
TI-2023-20936 Aliases CVE-2023-40046GHSA-m857-4vjp-6jvc

WS_FTP Server SQL Injection via Administrative Interface

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01009 63rd percentileScored 2026-11-07
Fix Fixed WS_FTP Server (Progress Software Corporation): 8.8.2, 8.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressWS_FTP Server8.8.0 to before 8.8.2; 8.7.0 to before 8.7.48.8.2, 8.7.4Patch availableCNA
  • WS_FTP Server VendorProgress Affected 8.8.0 to before 8.8.2; 8.7.0 to before 8.7.4 Fixed in 8.8.2, 8.7.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*before 8.7.4; 8.8 to before 8.8.2VulnerableProgress
  • cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* Versions before 8.7.4; 8.8 to before 8.8.2 Vulnerable ·Progress

Remediation

  • Fix · CNA WS_FTP Server (Progress Software Corporation) Fixed in 8.8.2, 8.7.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress Software WS_FTP Server — community.progress.com/s/article/WS-FTP-Server-Critical-Vul…

    7 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization VulnerabilityPriority CRITICAL 100
    • TI-2023-22761 WS_FTP Server Directory TraversalPriority MEDIUM 59
    • TI-2023-20935 WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting VulnerabilityPriority MEDIUM 40
    Show all 7 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40046
  2. 2026-10-03 Alias added: GHSA-m857-4vjp-6jvc

References

Advisory 1

Other 1

  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2003-00715 Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a… CVSS 2.0HIGH 7.5
  • TI-2006-04675 Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote… CVSS 2.0MEDIUM 6.5
  • TI-2006-04816 Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other… CVSS 2.0MEDIUM 6.5
  • TI-2001-00976 Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long… CVSS 2.0HIGH 7.5
  • TI-2023-22761 WS_FTP Server Directory Traversal CVSS 3.1CRITICAL 9.9
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences