CVE-2019-16116

EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N

EPSS

3.68% chance of exploitation in the next 30 days, 90th percentile

Published

2019-10-02

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48657

Security advisories

• https://enterprisedt.com/products/completeftp/doc/guide/html/history.html
• https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2…

References

• CVE Record
• NVD entry