High severity · published Jul 18, 2022
CVE-2016-15003
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic
7.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Filezilla Client · Filezilla-project
3.17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-15003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-15003
Third Party Advisory
https://vuldb.com/?id.97204
Exploit
https://www.exploit-db.com/exploits/39803/
Exploit
https://youtu.be/r06VwwJ9J4M
More from Filezilla Client
9.8
CVE-2023-53959
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory
7.8
CVE-2019-5429
Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory
6.5
CVE-2022-29620
FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability
5.9
CVE-2024-31497
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60…
5.9
CVE-2023-48795
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…