High severity · published Mar 7, 2020
CVE-2020-9470
An issue was discovered in Wing FTP Server 6.2.5 before February 2020
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wing Ftp Server · Wftpserver
through 6.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9470
Exploit
https://www.hooperlabs.xyz/disclosures/cve-2020-9470.php
More from Wing Ftp Server
10.0
CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
4.3
CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability
8.8
CVE-2020-37032
Wing FTP Server 6.3.8 - Remote Code Execution
8.8
CVE-2025-27889
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link
8.8
CVE-2023-37881
Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0