CVE-2021-44076
Medium
Description
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.
SeverityMedium
CVSS4.8
Exploit probability—
ProductCrushftp
PublishedSep 15, 2022
First seenSep 15, 2022
How to fix
Update
- crushftp crushftp9.4.0_15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crushftp crushftp | 9.0.0 ≤ v < 9.4.0_15 | 9.4.0_15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.