Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 05/10/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| ws ftp server | ≥ 8.8, < 8.8.2< 8.7.4 | 8.8.28.7.4 |
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free