CVE-2020-9470

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 6.2.5

Description An issue was discovered due to insecure permissions when handling session cookies. A local user may view the contents of the session and session admin directories, exposing active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.

Recommendations For Wing FTP Server versions prior to 6.2.5, update to a version released after February 2020 to resolve the issue. As a temporary workaround, consider restricting access to the session and session admin directories to minimize the risk of exploitation.