CVE-2023-45198

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

0.49%

Published

Oct 5, 2023

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products (2)

netbsd · ftpd (up to 2023-09-30)vulnerable

netbsd · tnftpd (up to 2023-10-01)vulnerable

References (4)

http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95

Patch

https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html

Mailing ListVendor Advisory

http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95

Patch

https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html

Mailing ListVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs