CVE-2023-45688
published 2023-10-16CVE-2023-45688: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of…
PriorityP426medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.63%
45.7th percentile
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| south_river_technologies | titan_mft | <= 2.0.17.2298 | — |
| south_river_technologies | titan_sftp | <= 2.0.17.2298 | — |
| southrivertech | titan_mft_server | < 2.0.18 | 2.0.18 |
| southrivertech | titan_sftp_server | < 2.0.18 | 2.0.18 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_oracle7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vpx5-mhrx-64h5: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the
ghsa_unreviewed·2023-10-16
CVE-2023-45688 [MEDIUM] CWE-22 GHSA-vpx5-mhrx-64h5: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command
Oracle
Oracle Oracle Communications Risk Matrix: CMP (JSON-java) — CVE-2022-45688
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2022-45688 [HIGH] Oracle Oracle Communications Risk Matrix: CMP (JSON-java) — CVE-2022-45688
Oracle Oracle Communications Risk Matrix: CMP (JSON-java) vulnerability
CVE: CVE-2022-45688
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (JSON-java) — CVE-2022-45688
vendor_oracle·2023-07-15·CVSS 7.5
CVE-2022-45688 [HIGH] Oracle Oracle Communications Risk Matrix: Configuration (JSON-java) — CVE-2022-45688
Oracle Oracle Communications Risk Matrix: Configuration (JSON-java) vulnerability
CVE: CVE-2022-45688
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
2023-10-16
Published