Medium severity · published Feb 10, 2020
CVE-2019-19660
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
Rumpus · Maxum
8.2.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19660
Third Party Advisory
https://github.com/harshit-shukla/CVE
Third Party Advisory
https://raw.githubusercontent.com/harshit-shukla/CVE/master/CVE-2019-19660.md
More from Rumpus
9.8
CVE-2025-55058
CWE-20 Improper Input Validation
9.8
CVE-2025-55055
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
8.8
CVE-2025-55057
Multiple CWE-352 Cross-Site Request Forgery (CSRF)
8.8
CVE-2022-46368
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users
8.8
CVE-2022-46367
Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation