Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions allows remote authenticated users to delete arbitrary files via a .. (dot dot) in the DELE command. NOTE: some of these details are obtained from third party information.
Threat-Mapped Scoring
Score: 0.0
Priority: Unclassified
EPSS
Score: 0.01812 Percentile:
0.82039
CVSS Scoring
CVSS v3.1 Score: 8.1
Severity: HIGH
Mapped CWE(s)
CWE-22
: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
All CAPEC(s)
CAPEC-126: Path Traversal
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-76: Manipulating Web Input to File System Calls
CAPEC-78: Using Escaped Slashes in Alternate Encoding