CVE-2023-40047

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads.  Once the cross-site scripting payload is successfully stored,  an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Progress Software CorporationWS_FTP Server>= 8.8.0, < 8.8.2
progressws_ftp_server>= 8.8.0, < 8.8.2

References

Timeline

Published
Sep 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-400486.5In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on aCVE-2023-400495.3In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.CVE-2023-40059.8Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.CVE-2023-400508.8Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with CVE-2023-400519.9This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation rCVE-2023-400527.5This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation rCVE-2023-400535.0A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function featuCVE-2023-400548.8The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows aCVE-2023-400558.8The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows aCVE-2023-400568.8SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged accoCVE-2023-400579.0The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability CVE-2023-400586.5Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager