Cross site scripting

2022-09-1513:15:00

PRIOn knowledge base

www.prio-n.com

cross-site scripting

crushftp 9

user creation

0.001 Low

EPSS

Percentile

25.0%

JSON

An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user’s page appears in the Most Visited section of the page.

CPENameOperatorVersion
crushftpge9.0.0
crushftplt9.4.0

CPE	Name	Operator	Version
	crushftp	ge	9.0.0
	crushftp	lt	9.4.0

References

labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp/

www.crushftp.com/

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for PRION:CVE-2021-44076