nvd-json-data-feeds/CVE-2020/CVE-2020-86xx/CVE-2020-8635.json

{
  "id": "CVE-2020-8635",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-03-07T00:15:13.303",
  "lastModified": "2021-07-21T11:39:23.747",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files."
    },
    {
      "lang": "es",
      "value": "Wing FTP Server versi\u00f3n v6.2.3 para Linux, macOS y Solaris establecen permisos no seguros en la instalaci\u00f3n de directorios y archivos de configuraci\u00f3n. Esto permite a usuarios locales crear usuarios FTP arbitrariamente con privilegios completos y escalar privilegios dentro del sistema operativo mediante la modificaci\u00f3n de los archivos del sistema."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wftpserver:wing_ftp_server:6.2.3:*:*:*:*:linux:*:*",
              "matchCriteriaId": "A2057B2F-6A30-4493-9E0B-E73C67470D1B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wftpserver:wing_ftp_server:6.2.3:*:*:*:*:macos:*:*",
              "matchCriteriaId": "CFBEB412-B9C5-4216-B30C-A2616DE155B7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wftpserver:wing_ftp_server:6.2.3:*:*:*:*:solaris:*:*",
              "matchCriteriaId": "29A1D238-E336-4AFB-906D-691D141A1570"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}