Описание
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 11.0.1 (включая) до 11.3.7_57 (исключая)
cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
EPSS
Процентиль: 15%
0.0005
Низкий
4.1 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
github
3 месяца назад
A stored cross-site scripting (XSS) vulnerability in the CrushFTP 11.3.7_50 Admin Panel (Reports / 'Who Created Folder') allows authenticated attackers with permissions to create folders to inject malicious HTML/JavaScript.
EPSS
Процентиль: 15%
0.0005
Низкий
4.1 Medium
CVSS3
Дефекты
CWE-79