CVE-2025-27889
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-07-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wftpserver | wing_ftp_server | to 7.4.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Wing FTP Server versions before 7.4.4, where the server does not properly validate and sanitize the 'url' parameter of the downloadpass.html endpoint. This flaw allows an attacker to inject an arbitrary link. If a user clicks on a crafted malicious link, it can lead to the disclosure of a cleartext password to the attacker.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can obtain a user's cleartext password if the user clicks on a specially crafted link exploiting the flaw. This can lead to unauthorized access to user accounts or sensitive information, compromising security and privacy.