What’s Vulnerable › Vulnerabilities

CVE-2023-45687: Authentication bypass via session fixation in Titan MFT and Titan SFTP servers

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-384

Description

A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing

Affected products

• Southrivertech Titan Mft Server: before 2.0.18 — fixed in 2.0.18
• Southrivertech Titan Sftp Server: before 2.0.18 — fixed in 2.0.18

How to fix

Upgrade to a fixed version: Southrivertech Titan Mft Server 2.0.18; Southrivertech Titan Sftp Server 2.0.18. Check the vendor advisory for mitigations.

References

• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Get alerted when CVE-2023-45687 or the next vulnerability affects your stack