Medium severity · published Feb 10, 2020
CVE-2019-19668
A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the…
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rumpus Ftp · Maxum
8.2.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19668
Third Party Advisory
https://github.com/harshit-shukla/CVE
Third Party Advisory
https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19668.md
More from Rumpus Ftp
7.1
CVE-2019-19664
A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1
6.5
CVE-2019-19669
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1
6.5
CVE-2019-19662
A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1
6.1
CVE-2019-19670
A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1
6.1
CVE-2019-19661
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp