CVE-2023-45198 Information disclosure in n/a

High 7.5 Published 5 Oct 2023 Updated 19 Sep 2024

Unauthenticated attackers can leak host filesystem information via MLSD or MLST commands in NetBSD ftpd and tnftpd.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-45198?

CVE-2023-45198 is a high-severity vulnerability in n/a, published on 5 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.

Which versions are affected by CVE-2023-45198?

It affects 2 products.

Products include Netbsd Ftpd, Netbsd Tnftpd.

How do I fix CVE-2023-45198?

No fix has been published for CVE-2023-45198 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-45198 being exploited?

There is no known exploitation of CVE-2023-45198 in the wild and no public exploit code.

CVE-2002-2245 Other in n/a Medium 5.0

Sources

Also known as GHSA-65vw-3j28-v49q.