Junglewise Threat Intelligence

CVE-2023-40044: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

CVE-2023-40044 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2023-10-05

Vendors: Progress, Progress Software Corporation.

Executive brief

A .NET deserialization vulnerability in the Ad Hoc Transfer module of Progress WS_FTP Server allows a pre-authenticated attacker to execute remote commands on the underlying operating system. The vulnerability is exploited by sending specially crafted untrusted data to the server.

Affected products

  • Progress Software Corporation WS_FTP Server versions prior to 8.7.4 and 8.8.2

Timeline

  • 2023-10-05: disclosed
  • 2023-10-05: kev added: Added to CISA Known Exploited Vulnerabilities Catalog