CVE-2017-15269

Published: Nov 15, 2017Modified: May 13, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. These can be performed using "nmap -b" and allow performing scans via the FTP server.

Affected (1)

Products: Psftp: Psftpd

Psftp

1 product

Psftpd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Psftp Psftpd	Version 10.0.4

Related CWEs

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References (6)

http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/541518/100/0/threaded

Source: cve@mitre.org

https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/

Source: cve@mitre.org

Third Party Advisory

http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/541518/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.