嗯，用户让我帮忙总结一篇文章，控制在100字以内，而且不需要用“文章内容总结”或者“这篇文章”这样的开头。直接写描述就行。 首先，我需要仔细阅读文章内容。文章主要讲的是美国CISA机构将Wing FTP Server的一个漏洞加入到已知被利用的漏洞目录中。漏洞编号是CVE-2025-47813，CVSS评分为4.3。这个漏洞影响的是Wing FTP Server 7.4.4之前的版本，属于信息泄露类型。 具体来说，当攻击者发送一个过长的UID cookie时，服务器会在处理过程中返回错误，泄露完整的本地安装路径。虽然这个漏洞本身不会导致远程代码执行，但泄露的文件系统细节可能帮助攻击者进行进一步的侦察和攻击。 CISA要求联邦机构在2026年3月30日前修复这个漏洞，并建议私营组织也检查和修复相关漏洞。 接下来，我需要将这些信息浓缩到100字以内。重点包括：CISA将Wing FTP Server的CVE-2025-47813漏洞加入目录，该漏洞导致信息泄露，影响旧版本服务器，可能被用于进一步攻击，修复截止日期是2026年3月30日。 现在组织语言：美国网络安全和基础设施安全局（CISA）将 Wing FTP Server 的 CVE-2025-47813 漏洞加入已知被利用漏洞目录。该漏洞可能导致信息泄露，影响旧版本服务器，并可能被用于进一步攻击。CISA要求联邦机构在 2026 年 3 月 30 日前修复此漏洞。 </think> 美国网络安全和基础设施安全局（CISA）将 Wing FTP Server 的 CVE-2025-47813 漏洞加入已知被利用漏洞目录。该漏洞可能导致信息泄露，影响旧版本服务器，并可能被用于进一步攻击。CISA要求联邦机构在 2026 年 3 月 30 日前修复此漏洞。 2026-3-16 21:8:53 Author: securityaffairs.com(查看原文) 阅读量:8 收藏
U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Wing FTP Server flaw, tracked as CVE-2025-47813 (CVSS score of 4.3), to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2025-47813 is an information disclosure vulnerability affecting Wing FTP Server versions prior to 7.4.4. The issue occurs in the loginok.html page during the web authentication process.
“loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.” reads the advisory.
The flaw occurs when an attacker sends an excessively long UID cookie, triggering improper input handling that causes the server to return an error revealing the full local installation path. While it does not enable remote code execution, the leak exposes filesystem details that could aid reconnaissance and facilitate further attacks such as path-based exploitation or file inclusion attempts.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by March 30, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
如有侵权请联系:admin#unsafe.sh