Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ws_ftp | Ipswitch | * | 6.1 (including) |
| Ws_ftp | Ipswitch | 1.0.5 (including) | 1.0.5 (including) |
| Ws_ftp | Ipswitch | 2.01 (including) | 2.01 (including) |
| Ws_ftp | Ipswitch | 2.02 (including) | 2.02 (including) |
| Ws_ftp | Ipswitch | 2.03 (including) | 2.03 (including) |
| Ws_ftp | Ipswitch | 3.0 (including) | 3.0 (including) |
| Ws_ftp | Ipswitch | 3.0.1 (including) | 3.0.1 (including) |
| Ws_ftp | Ipswitch | 3.1.0 (including) | 3.1.0 (including) |
| Ws_ftp | Ipswitch | 3.1.1 (including) | 3.1.1 (including) |
| Ws_ftp | Ipswitch | 3.1.2 (including) | 3.1.2 (including) |
| Ws_ftp | Ipswitch | 3.1.3 (including) | 3.1.3 (including) |
| Ws_ftp | Ipswitch | 3.14 (including) | 3.14 (including) |
| Ws_ftp | Ipswitch | 4.00 (including) | 4.00 (including) |
| Ws_ftp | Ipswitch | 4.01 (including) | 4.01 (including) |
| Ws_ftp | Ipswitch | 4.02 (including) | 4.02 (including) |
| Ws_ftp | Ipswitch | 5.00 (including) | 5.00 (including) |
| Ws_ftp | Ipswitch | 5.01 (including) | 5.01 (including) |
| Ws_ftp | Ipswitch | 5.02 (including) | 5.02 (including) |
| Ws_ftp | Ipswitch | 5.03 (including) | 5.03 (including) |
| Ws_ftp | Ipswitch | 5.04 (including) | 5.04 (including) |
| Ws_ftp | Ipswitch | 5.05 (including) | 5.05 (including) |
| Ws_ftp | Ipswitch | 6.0 (including) | 6.0 (including) |