Back to Database
Status published
Medium
CVE-2019-9648
An issue was discovered in the SFTP Server component in...
Vulnerability Description
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9648
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/107446
- http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
- https://www.exploit-db.com/exploits/46535
- https://seclists.org/fulldisclosure/2019/Mar/23
- http://seclists.org/fulldisclosure/2019/Aug/21
- http://packetstormsecurity.com/files/154204/CoreFTP-Server-SIZE-Directory-Traversal.html
More from coreftp
View All →CVE-2022-22899
Core FTP / SFTP Server v2 Build 725 was discovered...
Medium
5.5
CVE-2022-22836
CoreFTP Server before 727 allows directory traversal (for file creation)...
Medium
6.5
CVE-2020-21588
Buffer overflow in Core FTP LE v2.2 allows local attackers...
Medium
5.5
CVE-2020-19596
Buffer overflow vulnerability in Core FTP Server v1.2 Build 583,...
Critical
9.8
CVE-2020-19595
Buffer overflow vulnerability in Core FTP Server v2 Build 697,...
High
7.5
Affected Vendor
coreftp
View all reports →Affected Software
core ftp
Vulnerable Versions:
2.0
Timeline
Official Publish:
March 22nd, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.