Security Advisory for SFTPPlus 4.28.0

A security advisory was created for SFTPPlus version 4.28.0 affecting customers using the AS2 protocol to receive files without HTTP authentication.

Published
2023-03-08
Tags
security-advisory

We have released SFTPPlus version 4.28.0, which improves the security of the AS2 server.

SFTPPlus now stores the AS2 files that have not yet been validated in a separate pending folder, which cannot be the base home folder path.

This avoids having invalid files in the final destination path.

This should only be a security concern for customers receiving AS2 files without HTTP authentication.

The upgrade is recommended for all customers using SFTPPlus to receive files over the AS2 protocol.

You can check the full release notes here.