CVE-2019-9649

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html
http://seclists.org/fulldisclosure/2019/Aug/22
http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509Product, Vendor Advisory
http://www.securityfocus.com/bid/107449Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2019/Mar/25Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/46534Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html
http://seclists.org/fulldisclosure/2019/Aug/22
http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509Product, Vendor Advisory
http://www.securityfocus.com/bid/107449Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2019/Mar/25Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/46534Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96506.1An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.CVE-2019-96519.8An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not st CVE-2019-96528.8There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parame CVE-2019-96539.8NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac CVE-2019-96568.8An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/o CVE-2019-96577.8Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect p CVE-2019-96585.3Checkstyle before 8.18 loads external DTDs by default.CVE-2019-96599.1The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger t CVE-2019-96604.8Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter.CVE-2019-96614.8Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter,CVE-2019-96627.5An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted vi CVE-2019-96687.5An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause