CVE-2008-5692

Published: Dec 19, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.

Affected (22)

Products: Ipswitch: Ws Ftp

1 product

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Ipswitch Ws Ftp	Up to 6.1
Ipswitch Ws Ftp	Version 1.0.5
Ipswitch Ws Ftp	Version 2.01
Ipswitch Ws Ftp	Version 2.02
Ipswitch Ws Ftp	Version 2.03
Ipswitch Ws Ftp	Version 3.0.1
Ipswitch Ws Ftp	Version 3.0
Ipswitch Ws Ftp	Version 3.1.0
Ipswitch Ws Ftp	Version 3.1.1
Ipswitch Ws Ftp	Version 3.1.2
Ipswitch Ws Ftp	Version 3.1.3
Ipswitch Ws Ftp	Version 3.14
Ipswitch Ws Ftp	Version 4.00
Ipswitch Ws Ftp	Version 4.01
Ipswitch Ws Ftp	Version 4.02
Ipswitch Ws Ftp	Version 5.00
Ipswitch Ws Ftp	Version 5.01
Ipswitch Ws Ftp	Version 5.02
Ipswitch Ws Ftp	Version 5.03
Ipswitch Ws Ftp	Version 5.04
Ipswitch Ws Ftp	Version 5.05
Ipswitch Ws Ftp	Version 6.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (16)

http://aluigi.altervista.org/adv/wsftpweblog-adv.txt

Source: cve@mitre.org

http://docs.ipswitch.com/WS_FTP_Server611/ReleaseNotes/index.htm?k_id=ipswitch_ftp_documents_worldwide_ws_ftpserverv611releasenotes#link12

Source: cve@mitre.org

http://secunia.com/advisories/28822

Source: cve@mitre.org

http://securityreason.com/securityalert/4799

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/487686/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/487697/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27654

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0473

Source: cve@mitre.org

http://aluigi.altervista.org/adv/wsftpweblog-adv.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://docs.ipswitch.com/WS_FTP_Server611/ReleaseNotes/index.htm?k_id=ipswitch_ftp_documents_worldwide_ws_ftpserverv611releasenotes#link12

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/28822

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/4799

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/487686/100/200/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/487697/100/200/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/27654

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/0473

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.