CVE-2023-43177

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

81.80% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-913

Published

2023-11-17

Updated

2024-09-04

Proof-of-concept exploits (5)

• https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/
• Mohammaddvd/CVE-2024-40405★ · 2024-04-30
• entroychang/CVE-2024-40403★ · 2024-07-09
• the-emmons/CVE-2023-4317717★ · 2024-06-14
• dhammerg/CVE-2024-4040

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43177.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/crushftp_rce_cve_2023…

References

• CVE Record
• NVD entry

Related

• CVE-2023-33669
• CVE-2023-3519
• CVE-2024-4040
• CVE-2022-4047
• CVE-2023-4317
• CVE-2023-4318