A vulnerability has been found in South River MFT Server and Titan SFTP Server on Windows (SSH Server Software) (affected version not known) and classified as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. The summary by CVE is:

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal

The weakness was presented 10/16/2023. The advisory is shared at rapid7.com. This vulnerability is known as CVE-2023-45689 since 10/10/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-242289, VDB-242290, VDB-242291 and VDB-242292 for similar entries.

Productinfo

Type

• SSH Server Software

Vendor

• South River

Name

• MFT Server
• Titan SFTP Server

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion