CVE-2023-45198 - Vulnerability Details - OpenCVE

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Netbsd	Ftpd Tnftpd

Configuration 1 [-]

OR	cpe:2.3:a:netbsd:ftpd::::::::
	cpe:2.3:a:netbsd:tnftpd::::::::

No data.

References

Link	Providers
http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html

History

Thu, 19 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-05T00:00:00

Updated: 2024-09-19T17:42:09.742Z

Reserved: 2023-10-05T00:00:00

Link: CVE-2023-45198

Vulnrichment

Updated: 2024-08-02T20:14:19.800Z

NVD

Status : Modified

Published: 2023-10-05T05:15:42.257

Modified: 2024-11-21T08:26:32.040

Link: CVE-2023-45198

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netbsd:ftpd:*:*:*:*:*:*:*:*", "matchCriteriaId": "D23DFEC0-011A-4066-8D10-CF671F9A01D3", "versionEndExcluding": "2023-09-30", "vulnerable": true}, {"criteria": "cpe:2.3:a:netbsd:tnftpd:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2404151-669D-403F-951D-7F4795BA2033", "versionEndExcluding": "2023-10-01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ftpd before \"NetBSD-ftpd 20230930\" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable."}, {"lang": "es", "value": "ftpd antes de \"NetBSD-ftpd 20230930\" puede filtrar informaci\u00f3n sobre el sistema de archivos del host antes de la autenticaci\u00f3n mediante un comando MLSD o MLST. tnftpd (la versi\u00f3n port\u00e1til de NetBSD ftpd) anterior a 20231001 tambi\u00e9n es vulnerable."}], "id": "CVE-2023-45198", "lastModified": "2024-11-21T08:26:32.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-05T05:15:42.257", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}