CVE-2020-8635

Published: Mar 7, 2020Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.

Affected (3)

Products: Wftpserver: Wing Ftp Server

1 product

Wing Ftp Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Wftpserver Wing Ftp Server	Version 6.2.3
Wftpserver Wing Ftp Server	Version 6.2.3
Wftpserver Wing Ftp Server	Version 6.2.3

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.