Read the docs
TI-2023-22761 Aliases CVE-2023-42657GHSA-vrp3-qmw4-rx8c

WS_FTP Server Directory Traversal

Priority MEDIUM 59CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path.  Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.16008 96th percentileScored 2026-11-07
Fix Fixed WS_FTP Server (Progress Software Corporation): 8.8.2, 8.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressWS_FTP Server8.8.0 to before 8.8.2; 8.7.0 to before 8.7.48.8.2, 8.7.4Patch availableCNA
  • WS_FTP Server VendorProgress Affected 8.8.0 to before 8.8.2; 8.7.0 to before 8.7.4 Fixed in 8.8.2, 8.7.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*before 8.7.4; 8.8.0 to before 8.8.2VulnerableProgress
  • cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* Versions before 8.7.4; 8.8.0 to before 8.8.2 Vulnerable ·Progress

Remediation

  • Fix · CNA WS_FTP Server (Progress Software Corporation) Fixed in 8.8.2, 8.7.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress Software WS_FTP Server — community.progress.com/s/article/WS-FTP-Server-Critical-Vul…

    7 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization VulnerabilityPriority CRITICAL 100
    • TI-2023-20935 WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting VulnerabilityPriority MEDIUM 40
    • TI-2023-20937 WS_FTP Server Stored Cross-Site Scripting VulnerabilityPriority LOW 38
    Show all 7 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42657
  2. 2026-10-03 Alias added: GHSA-vrp3-qmw4-rx8c

References

Advisory 1

Other 1

  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2003-00715 Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a… CVSS 2.0HIGH 7.5
  • TI-2006-04675 Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote… CVSS 2.0MEDIUM 6.5
  • TI-2006-04816 Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other… CVSS 2.0MEDIUM 6.5
  • TI-2001-00976 Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long… CVSS 2.0HIGH 7.5
  • TI-2008-00562 Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated… CVSS 2.0HIGH 9.0
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences