{"api_version":"1","generated_at":"2026-07-23T05:38:24+00:00","cve":"CVE-2008-4247","urls":{"html":"https://cve.report/CVE-2008-4247","api":"https://cve.report/api/cve/CVE-2008-4247.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4247","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4247"},"summary":{"title":"CVE-2008-4247","description":"ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-09-25 19:25:18","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc","name":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html","name":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Critical Patch Update Pre-Release Announcement - October 2010","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc","name":"http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32068","name":"http://secunia.com/advisories/32068","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"NetBSD ftpd Long Command Processing Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c","name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVS Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/4313","name":"http://securityreason.com/securityalert/4313","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"multiple vendor ftpd - Cross-site request forgery - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugs.proftpd.org/show_bug.cgi?id=3115","name":"http://bugs.proftpd.org/show_bug.cgi?id=3115","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 3115 – Cross-site request forgery","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1021112","name":"http://www.securitytracker.com/id?1021112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"NetBSD ftpd Request Processing Bug Permits Cross-Site Request Forgery Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y","name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVS Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/33341","name":"http://secunia.com/advisories/33341","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"FreeBSD ftpd Long Command Processing Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h","name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"src/libexec/ftpd/ftpcmd.y - diff - 1.52","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1020946","name":"http://www.securitytracker.com/id?1020946","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker: BSD ftpd Request Processing Bug Permits Cross-Site Request Forgery Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32070","name":"http://secunia.com/advisories/32070","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"OpenBSD ftpd Long Command Processing Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/achievement_securityalert/56","name":"http://securityreason.com/achievement_securityalert/56","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityReason - multiple vendor ftpd - Cross-site request forgery ( Research Advisory )","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h","name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"src/libexec/ftpd/ftpd.c - diff - 1.184","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4247","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4247","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"freebsd","cpe5":"freebsd","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"netbsd","cpe5":"netbsd","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"openbsd","cpe5":"openbsd","cpe6":"4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:08:34.975Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1021112","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1021112"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h"},{"name":"1020946","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020946"},{"name":"20080926 multiple vendor ftpd - Cross-site request forgery","tags":["third-party-advisory","x_refsource_SREASONRES","x_transferred"],"url":"http://securityreason.com/achievement_securityalert/56"},{"name":"33341","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/33341"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://bugs.proftpd.org/show_bug.cgi?id=3115"},{"name":"NetBSD-SA2008-014","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred"],"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y"},{"name":"32068","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32068"},{"name":"FreeBSD-SA-08:12","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred"],"url":"http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"},{"name":"32070","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32070"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h"},{"name":"4313","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/4313"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-09-20T00:00:00.000Z","descriptions":[{"lang":"en","value":"ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2008-10-07T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1021112","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1021112"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h"},{"name":"1020946","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020946"},{"name":"20080926 multiple vendor ftpd - Cross-site request forgery","tags":["third-party-advisory","x_refsource_SREASONRES"],"url":"http://securityreason.com/achievement_securityalert/56"},{"name":"33341","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/33341"},{"tags":["x_refsource_MISC"],"url":"http://bugs.proftpd.org/show_bug.cgi?id=3115"},{"name":"NetBSD-SA2008-014","tags":["vendor-advisory","x_refsource_NETBSD"],"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y"},{"name":"32068","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32068"},{"name":"FreeBSD-SA-08:12","tags":["vendor-advisory","x_refsource_FREEBSD"],"url":"http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"},{"name":"32070","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32070"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h"},{"name":"4313","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/4313"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4247","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1021112","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1021112"},{"name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h","refsource":"CONFIRM","url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h"},{"name":"1020946","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1020946"},{"name":"20080926 multiple vendor ftpd - Cross-site request forgery","refsource":"SREASONRES","url":"http://securityreason.com/achievement_securityalert/56"},{"name":"33341","refsource":"SECUNIA","url":"http://secunia.com/advisories/33341"},{"name":"http://bugs.proftpd.org/show_bug.cgi?id=3115","refsource":"MISC","url":"http://bugs.proftpd.org/show_bug.cgi?id=3115"},{"name":"NetBSD-SA2008-014","refsource":"NETBSD","url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc"},{"name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y","refsource":"CONFIRM","url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y"},{"name":"32068","refsource":"SECUNIA","url":"http://secunia.com/advisories/32068"},{"name":"FreeBSD-SA-08:12","refsource":"FREEBSD","url":"http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc"},{"name":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"},{"name":"32070","refsource":"SECUNIA","url":"http://secunia.com/advisories/32070"},{"name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h","refsource":"CONFIRM","url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h"},{"name":"4313","refsource":"SREASON","url":"http://securityreason.com/securityalert/4313"},{"name":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c","refsource":"CONFIRM","url":"http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4247","datePublished":"2008-09-25T19:00:00.000Z","dateReserved":"2008-09-25T00:00:00.000Z","dateUpdated":"2024-08-07T10:08:34.975Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-09-25 19:25:18","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:*","matchCriteriaId":"47E0A416-733A-4616-AE08-150D67FCEA70"},{"vulnerable":true,"criteria":"cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:*","matchCriteriaId":"9875E709-11BA-4B8F-A2FC-26844DD4D563"},{"vulnerable":true,"criteria":"cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:*","matchCriteriaId":"F12313A0-1EAF-4652-9AB1-799171CFFEA9"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4247","Ordinal":"1","Title":"CVE-2008-4247","CVE":"CVE-2008-4247","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4247","Ordinal":"1","NoteData":"ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.","Type":"Description","Title":"CVE-2008-4247"},{"CveYear":"2008","CveId":"4247","Ordinal":"2","NoteData":"2008-09-25","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4247","Ordinal":"3","NoteData":"2008-10-07","Type":"Other","Title":"Modified"}]}}}