CVE-2021-44076

An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 52nd percentile

Published

2022-09-15

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp/

Security advisories

• https://www.crushftp.com
• https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp

References

• CVE Record
• NVD entry