CVE-2010-20113

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Stack-based Buffer Overflow pada easyftp server project easyftp server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.

Rincian

Terbit di NVD

21 Agustus 2025

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_lis... exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow advisory pihak ketiga
• https://www.exploit-db.com/exploits/11500 exploit · vdb entry