Description

A file containing SFTP/FTP connection credentials was found on this web server.

Some SFTP/FTP clients store SFTP/FTP connection details such as hostname, username, password in text files. For example Sublime SFTP is creating a file named sftp-config.json, FileZilla is storing the information in a file named recentservers.xml.

Remediation

Remove this file from the web server.

References

SFTP/FTP Password Exposure via sftp-config.json

Related Vulnerabilities

Reachable SharePoint interface

TCExam Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-20114)

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.4)

WordPress Plugin Metform Elementor Contact Form Builder-Flexible and Design-Friendly Contact Form builder for WordPress Information Disclosure (2.1.3)

SharePoint user enumeration

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure