Ben Spink CrushFTP FTP Server 2.1.6 and earlier allows a local attacker to access arbitrary files via a .. (dot dot) attack, or variations, in (1) GET, (2) CD, (3) NLST, (4) SIZE, (5) RETR.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Crushftp_ftp_server | Ben_spink | * | 2.1.6 (including) |
Crushftp_ftp_server | Ben_spink | 2.1.4 (including) | 2.1.4 (including) |