Description (CNA)
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Rapid7 / Metasploit Framework | affected 0 before 6.5.7 |
CWE
CWE-918