HIGH🇵🇱 Wersja polska

CVE-2022-34006

CVSS 7.8v3.1pub. 2022-06-19upd. 2024-11-21

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Southrivertech Titan Ftp Server Nextgen

    APP
    Southrivertech
    < 1.2.1050
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-34005CRITICAL9.8PL ✓same product

RCE przez zakodowane hasło konta SA w TitanFTP NextGen

CVE-2023-27744HIGH7.8same product

An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privile...

CVE-2023-27745HIGH8.8same product

An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to...

CVE-2023-45685CRITICAL9.1PL ✓same vendor

Path traversal przy rozpakowywaniu ZIP w Titan MFT i Titan SFTP Server

CVE-2023-45686HIGH7.2same vendor

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan S...