Medium severity · published Feb 10, 2020
CVE-2019-19669
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rumpus Ftp · Maxum
8.2.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19669
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19669
Third Party Advisory
https://github.com/harshit-shukla/CVE
Third Party Advisory
https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19669.md
More from Rumpus Ftp
7.1
CVE-2019-19664
A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1
6.5
CVE-2019-19662
A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1
6.1
CVE-2019-19670
A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1
6.1
CVE-2019-19661
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp
5.4
CVE-2019-19667
A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via…