CVE-2007-3769: XSS
Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3769?
CVE-2007-3769 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2007-3769?
To fix CVE-2007-3769, it is recommended to upgrade to a patched version of SurgeFTP that addresses this vulnerability.
What systems are affected by CVE-2007-3769?
CVE-2007-3769 affects all versions of NetWin SurgeFTP up to and including version 2.3a1.
What type of vulnerability is CVE-2007-3769?
CVE-2007-3769 is a cross-site scripting (XSS) vulnerability that allows the injection of arbitrary web script or HTML.
Is user interaction required for CVE-2007-3769 to be exploited?
Yes, CVE-2007-3769 requires user-assisted actions to exploit the vulnerability through a malformed server response.