CVE-2019-9649

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-22 · updated 2026-06-17
Weakness: CWE-22

Description

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.

Affected products

Coreftp Core FTP: 2.0

References

http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html
http://seclists.org/fulldisclosure/2019/Aug/22
http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
http://www.securityfocus.com/bid/107449
https://seclists.org/fulldisclosure/2019/Mar/25
https://www.exploit-db.com/exploits/46534
http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html
http://seclists.org/fulldisclosure/2019/Aug/22
http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
http://www.securityfocus.com/bid/107449
https://seclists.org/fulldisclosure/2019/Mar/25
https://www.exploit-db.com/exploits/46534

Get alerted when CVE-2019-9649 or the next vulnerability affects your stack