CVE-2020-8634

Published: Mar 7, 2020Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.

Affected (3)

Products: Wftpserver: Wing Ftp Server

1 product

Wing Ftp Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Wftpserver Wing Ftp Server	Version 6.2.3
Wftpserver Wing Ftp Server	Version 6.2.3
Wftpserver Wing Ftp Server	Version 6.2.3

Related CWEs

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (2)

https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.