Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-27665
CVE-2022-27665:
WS_FTP Server vulnerability analysis and mitigation
Overview
A reflected cross-site scripting (XSS) vulnerability exists in Progress Ipswitch WS_FTP Server 8.6.0, tracked as CVE-2022-27665. The vulnerability was discovered on March 22, 2022, and publicly disclosed on April 3, 2023. The vulnerability allows attackers to execute malicious code and commands on the client side through AngularJS sandbox escape expressions (Hacker News, NVD).
Technical details
The vulnerability is caused by improper handling of user-provided input in the subdirectory searchbar and Add folder filename boxes. Specifically, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).
Impact
When exploited, this vulnerability can lead to the execution of malicious code and commands on the client side. The attack requires user interaction and can result in compromised confidentiality and integrity of the affected system (NVD).
Mitigation and workarounds
Users are advised to upgrade to WSFTP Server 2022.0.2 (8.8.2) or WSFTP Server 2020.0.4 (8.7.4) as referenced in the Progress security advisory (Progress Release Notes).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management