Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2024-11986

Stored XSS in CrushFTP

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ENISA

Description

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CrushFTP, LLC CrushFTP

Default version status: unaffected

  • 10.0.0 to < 10.8.2affected
  • 11.0.0 to < 11.2.1affected

References