CVE-2023-45690: Information leak via default file permissions on Titan MFT and Titan SFTP servers

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-10-16 · updated 2026-06-17
Weakness: CWE-276

Description

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem

Affected products

Southrivertech Titan Ftp Server: through 2.0.16.2277
Southrivertech Titan Mft Server: before 2.0.18 — fixed in 2.0.18

How to fix

Upgrade to a fixed version: Southrivertech Titan Mft Server 2.0.18. Check the vendor advisory for mitigations.

References

https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Get alerted when CVE-2023-45690 or the next vulnerability affects your stack