CVE-2022-34006
Last modified
CVE-2022-34006 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Southrivertech | Titan Ftp Server Nextgen | < 1.2.1050 |
References
- https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdfRelease Notes, Vendor Advisory
- https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdfRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-34006?
How severe is CVE-2022-34006?
How do I fix CVE-2022-34006?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-33996Incorrect permission management in Devolutions Server before…8.8
- CVE-2022-3400The Bricks theme for WordPress is vulnerable to authorizatio…6.5
- CVE-2022-34000libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipe…6.5
- CVE-2022-34001Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsy…6.5
- CVE-2022-34002The ‘document’ parameter of PDS Vista 7’s /application/docum…6.5
- CVE-2022-34005An issue was discovered in TitanFTP (aka Titan FTP) NextGen …9.8
- CVE-2022-34007EQS Integrity Line Professional through 2022-07-01 allows a …6.1
- CVE-2022-34008Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allo…7.8
- CVE-2022-34009Fossil 2.18 on Windows allows attackers to cause a denial of…5.5
- CVE-2022-3401The Bricks theme for WordPress is vulnerable to remote code …8.8
- CVE-2022-34011OneBlog v2.3.4 was discovered to contain a Server-Side Reque…4.3
- CVE-2022-34012Insecure permissions in OneBlog v2.3.4 allows low-level admi…6.5
Are you affected by CVE-2022-34006?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST