Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

WS_FTP Server 3.1.1 lets logged-in users run code

CVE-2002-0826 · published 24 years ago
Summary

A flaw in WS_FTP Server version 3.1.1 lets users who have logged in send an overly long SITE CPWD command, causing the program to run any code the attacker chooses. This could let an attacker take control of the FTP server. Apply the vendor’s update or patch and restrict FTP access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
progress ws_ftp_server 3.1.1
cpe:2.3:a:progress:ws_ftp_server:3.1.1:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.
Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
12% chance of attack within 30 days
Timeline
Published12 Aug 2002
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-0826 · NVD
Track software like this
Free during beta