Description

A file containing SFTP/FTP connection credentials was found on this web server.

Some SFTP/FTP clients store SFTP/FTP connection details such as hostname, username, password in text files. For example Sublime SFTP is creating a file named sftp-config.json, FileZilla is storing the information in a file named recentservers.xml.

Remediation

Remove this file from the web server.

References

SFTP/FTP Password Exposure via sftp-config.json

Related Vulnerabilities

WordPress Plugin Advanced Contact form 7 DB Information Disclosure (1.6.2)

Payara Micro File Read (CVE-2021-41381)

WordPress Plugin Mailing List 'dl.php' Arbitrary File Download (1.4.1)

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.31)

WordPress Plugin File Manager Multiple Vulnerabilities (4.8)

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure