Description (CNA)
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Eclipse Foundation / NetX Duo | affected 0 through 6.5.1.202602 |
CWE
CWE-918
References
ADP enrichment
No English description supplied.
No references supplied.