Vulnerability Details CVE-2021-44076
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 67.6%
CVSS Severity
CVSS v3 Score 4.8
References
Products affected by CVE-2021-44076
-
cpe:2.3:a:crushftp:crushftp:9.0.0
-
cpe:2.3:a:crushftp:crushftp:9.1.0
-
cpe:2.3:a:crushftp:crushftp:9.2.0
-
cpe:2.3:a:crushftp:crushftp:9.3.0
-
cpe:2.3:a:crushftp:crushftp:9.3.2
-
cpe:2.3:a:crushftp:crushftp:9.4.0