CVE-2023-45198

HIGH EPSS 38.5%
Published Oct 5, 20232y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Oct 5, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
38.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 2

VendorProductVersionRange
netbsdftpd* <2023-09-30
netbsdtnftpd* <2023-10-01

References 2

  • cvsweb.netbsd.org http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
    Patch
  • mail-index.netbsd.org https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html
    Mailing ListVendor Advisory

Remediation

  • cvsweb.netbsd.org http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
    Patch