medium6.5Public exploit code
CVE-2022-22836
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CoreFTP Server build 725 - Directory Traversal (Authenticated)2022-01-10 · remote · windows
Impact
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Coreftp | Core Ftp | through 1.2 Version 2.0 |