PT-2022-11976 · Crushftp · Crushftp

Stavros Manis · Published 2022-09-15 · Updated 2022-09-17 · CVE-2021-44076

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CrushFTP version 9

Description An issue was discovered in the creation of a new user through the "/WebInterface/UserManager/" interface, allowing an attacker with access to the administration panel to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example, when the user's page appears in the Most Visited section of the page.

Recommendations For CrushFTP version 9, consider disabling the user creation feature through the /WebInterface/UserManager/ interface until a patch is available to prevent Stored Cross-Site Scripting (XSS) attacks. Restrict access to the administration panel to minimize the risk of exploitation. Avoid using the /WebInterface/UserManager/ interface for user creation until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44076

Affected Products

Crushftp

References · 6

• 🔥 https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44076 · Security Note
• https://crushftp.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44076 · Vendor Advisory
• https://t.me/cvenotify/36211 · Telegram Post
• https://t.me/cvenotify/36214 · Telegram Post