CVE-2015-4108

Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.

Affected products

Wing Ftp Server

Wftpserver Wing Ftp Server

≤ 4.4.6

Fix

Available

CVSS 2.0

6.8 MEDIUM

EPSS

2.4% (83th percentile)

Weakness

CWE-352

NVD status

Modified

Published

2015-06-10