HIGH🇬🇧 English

CVE-2022-34006

CVSS 7.8v3.1pub. 2022-06-19upd. 2024-11-21

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Southrivertech Titan Ftp Server Nextgen

    APP
    Southrivertech
    < 1.2.1050
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2022-34005CRITICAL9.8PL ✓ten sam produkt

RCE przez zakodowane hasło konta SA w TitanFTP NextGen

CVE-2023-27744HIGH7.8ten sam produkt

An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privile...

CVE-2023-27745HIGH8.8ten sam produkt

An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to...

CVE-2023-45685CRITICAL9.1PL ✓ten sam vendor

Path traversal przy rozpakowywaniu ZIP w Titan MFT i Titan SFTP Server

CVE-2023-45686HIGH7.2ten sam vendor

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan S...