PT-2024-17383 · Crushftp · Crushftp

Published 2024-12-13 · Updated 2024-12-14 · CVE-2024-11986

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue involves improper input handling in the 'Host Header', allowing an unauthenticated attacker to store a payload in web application logs. When an administrator views the logs, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11986

Affected Products

Crushftp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-11986 · Security Note
• https://twitter.com/CVEnew/status/1868033926427812078 · Twitter Post
• https://t.me/cvedetector/12872 · Telegram Post
• https://t.me/latest_high_impact_cve/1651 · Telegram Post
• https://crushftp.com/crush11wiki/Wiki.jsp?page=Update · Note