CVE-2008-4242: proftpd_project proftpd Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2008-4242 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in proftpd_project proftpd. EPSS estimates a 7.07% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-09-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.