Security Resilience

CVE-2024-1017

Gabriels Ftp Server Project Gabriels Ftp Server 1.2

Public PoC
Published
29 January 2024
Modified
17 June 2026
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.014 72th percentile
Risk Priority 47 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-1017 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Gabriels Ftp Server Project Gabriels Ftp Server. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 28% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument USERNAME leads to denial of service. The attack may be initiated remotely. The exploit…

more

has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252287.

CWE(s)
CWE-404

Related Threats

CVEs Like This One

CVE-2026-14626Shared CWE-404
CVE-2025-67635Shared CWE-404
CVE-2025-8799Shared CWE-404
CVE-2026-8226Shared CWE-404
CVE-2023-0850Shared CWE-404
CVE-2025-8805Shared CWE-404
CVE-2026-7708Shared CWE-404
CVE-2024-21253Shared CWE-404
CVE-2026-54280Shared CWE-404
CVE-2024-13009Shared CWE-404

Affected Assets

gabriels ftp server project
gabriels ftp server
1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover missing or incorrect resource releases after code is written.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can require explicit resource acquisition/release patterns that stop improper shutdown from being introduced.

SC-6 Resource Availability partial match

Priority-based resource allocation limits the blast radius when released resources are not returned to the pool.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.37 Documented operating procedures partial match
blocks

documenting procedures for secure operation, error handling, restart/recovery and resource management (including references to 8.13/8.18) is a governance and dependency control that does not itself stop exploitation of a resource-shutdown flaw; any prevention would require other controls (e.g. code changes or runtime enforcement) configured to act on it

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-404, a class-level weakness, and none of its children carries one either.

References