CVE-2024-7745: progress software corporation ws_ftp server Authentication Bypass by Spoofing

Vulnerability summary

CVE-2024-7745 is a high (CVSS 8.1) Authentication Bypass by Spoofing vulnerability in progress software corporation ws_ftp server. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.9% of scored vulnerabilities.

Timeline

1. 28-08-2024
   PublishedVulnerability first disclosed.
2. 28-08-2024
   Last modifiedVulnerability information updated.

Description

In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-304Missing Critical Step in AuthenticationThe product implements an authentication technique, but it skips a step that weakens the technique.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.