CVE-2022-34006

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050

published June 19, 2022

CVSS
—
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.5th percentile
Published
2022-06-19T20:25Z
EPSS history
Timeline
  • 19 JUN 20:25Z
    An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050
    cvelistv5