Vulnerability Intelligence Report
Stored XSS in CrushFTP
CVE-2024-11986
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
No Active Exploit Signals
CVSS Base Score
9.6
CRITICAL
Exploitability:2.9
Impact Score:6.1
EPSS Probability:0.55%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-79 ↗CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| CrushFTP, LLC | CrushFTP | 10.0.0 < 10.8.2 (affected), 11.0.0 < 11.2.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.554%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | EU Agency for Cybersecurity (ENISA) · Consortium · Greece |
| Reserved | 2024-11-29T07:20:34 |
| Published | 2024-12-13T13:46:54 |
| Last Updated | 2024-12-13T20:41:28 |
Community Chatter & Buzz