CVE-2008-7016: tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors,… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Aug 21, 2009

CVE-2008-7016

tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors,…

–

CVSS

0.6%

EPSS

No

On KEV

Description

tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 48% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TN

Tnftpd · Luke Mewburn

20040810; 20061217; 20080609 · source: NVD

Affected product

TN

Tnftpd

Luke Mewburn

All Tnftpd CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2008-7016

https://www.cve.org/CVERecord?id=CVE-2008-7016

http://freshmeat.net/projects/tnftpd/?branch_id=14355&release_id=285654#

http://osvdb.org/48637

Vendor Advisory

http://secunia.com/advisories/31958

exchange.xforce.ibmcloud.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/45534

More from Tnftpd

–

Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code