Unscored CVE-2023-45689 EUVD-2023-49978GHSA-9vp9-v4wh-433r

Arbitrary file read via path traversal in Titan MFT and Titan SFTP servers

Published Oct 16, 2023 · Updated Sep 16, 2024 · Assigned by rapid7

Vendor: South River Technologies Product: Titan MFT Product: Titan SFTP

Description

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal

Affected products

Vendor	Product	Affected	Fixed
South River Technologies	Titan MFT	≤ 2.0.17.2298	—
South River Technologies	Titan SFTP	≤ 2.0.17.2298	—

References

https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690