Back to Database
Status published
Medium
CVE-2019-9649
An issue was discovered in the SFTP Server component in...
Vulnerability Description
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9649
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/107449
- http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
- https://www.exploit-db.com/exploits/46534
- https://seclists.org/fulldisclosure/2019/Mar/25
- http://seclists.org/fulldisclosure/2019/Aug/22
- http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html
More from coreftp
View All →CVE-2022-22899
Core FTP / SFTP Server v2 Build 725 was discovered...
Medium
5.5
CVE-2022-22836
CoreFTP Server before 727 allows directory traversal (for file creation)...
Medium
6.5
CVE-2020-21588
Buffer overflow in Core FTP LE v2.2 allows local attackers...
Medium
5.5
CVE-2020-19596
Buffer overflow vulnerability in Core FTP Server v1.2 Build 583,...
Critical
9.8
CVE-2020-19595
Buffer overflow vulnerability in Core FTP Server v2 Build 697,...
High
7.5
Affected Vendor
coreftp
View all reports →Affected Software
core ftp
Vulnerable Versions:
2.0
Timeline
Official Publish:
March 22nd, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.