Unscored severity · published Dec 31, 2004
CVE-2004-1885
Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled by iftpmgr.exe.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
WS Ftp Server · Progress
4.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1885
marc.info
http://marc.info/?l=bugtraq&m=108006581418116&w=2
Exploit
http://secunia.com/advisories/11206
Exploit
http://www.securityfocus.com/bid/9953
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/15558
More from WS Ftp Server
8.8
CVE-2023-40044
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
9.6
CVE-2023-42657
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations…
8.8
CVE-2023-42659
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified
8.1
CVE-2024-7745
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor…
7.2
CVE-2023-40046
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface