Read the docs
TI-2023-22763 Aliases CVE-2023-42659

WS_FTP Server Arbitrary File Upload

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00896 59th percentileScored 2026-11-07
Fix Fixed WS_FTP Server (Progress Software Corporation): 8.8.4, 8.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressWS_FTP Server8.8.0 to before 8.8.4; 8.7.0 to before 8.7.68.8.4, 8.7.6Patch availableCNA
  • WS_FTP Server VendorProgress Affected 8.8.0 to before 8.8.4; 8.7.0 to before 8.7.6 Fixed in 8.8.4, 8.7.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*before 8.7.6; 8.8.0 to before 8.8.4VulnerableProgress
  • cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:* Versions before 8.7.6; 8.8.0 to before 8.8.4 Vulnerable ·Progress

Remediation

  • Fix · CNA WS_FTP Server (Progress Software Corporation) Fixed in 8.8.4, 8.7.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42659

References

Advisory 1

Other 1

  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2003-00715 Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a… CVSS 2.0HIGH 7.5
  • TI-2006-04675 Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote… CVSS 2.0MEDIUM 6.5
  • TI-2006-04816 Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1, and possibly other… CVSS 2.0MEDIUM 6.5
  • TI-2001-00976 Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long… CVSS 2.0HIGH 7.5
  • TI-2023-22761 WS_FTP Server Directory Traversal CVSS 3.1CRITICAL 9.9
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences