CVE-2020-9470: High severity Wftpserver Wing Ftp Server vulnerability
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and sessionadmin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-9470?
CVE-2020-9470 is a vulnerability discovered in Wing FTP Server 6.2.5 before February 2020 that allows a local user to view the contents of session and session_admin directories due to insecure permissions when handling session cookies.
What is the severity of CVE-2020-9470?
The severity of CVE-2020-9470 is high with a CVSS score of 7.8.
How does CVE-2020-9470 affect Wing FTP Server?
CVE-2020-9470 affects Wing FTP Server 6.2.5 by exposing active session cookies within the Wing FTP HTTP interface and administration.
How can I fix CVE-2020-9470?
To fix CVE-2020-9470, it is recommended to update Wing FTP Server to a version after February 2020 where this vulnerability has been addressed.
Where can I find more information about CVE-2020-9470?
More information about CVE-2020-9470 can be found at this reference link: [CVE-2020-9470](https://www.hooperlabs.xyz/disclosures/cve-2020-9470.php)