1. CVE-Search
  2. CVE-2007-3769
ID CVE-2007-3769
Summary Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.
References
Vulnerable Configurations
  • cpe:2.3:a:netwin:surgeftp:1.1h:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:1.1h:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.0c:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.0c:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.0d:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.0d:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.0e:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.0e:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.0f:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.0f:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.2k1:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.2k1:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.2k3:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.2k3:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.2m1:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.2m1:*:*:*:*:*:*:*
  • cpe:2.3:a:netwin:surgeftp:2.3a1:*:*:*:*:*:*:*
    cpe:2.3:a:netwin:surgeftp:2.3a1:*:*:*:*:*:*:*
CVSS
Base: 5.8 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:P
refmap via4
fulldisc 20070710 Portcullis Computer Security Ltd - Advisories
misc http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0031.txt
osvdb 37911
secunia 26061
vupen ADV-2007-2528
xf surgeftp-error-xss(35378)
Last major update 29-07-2017 - 01:32
Published 15-07-2007 - 21:30
Last modified 29-07-2017 - 01:32
Back to Top