CrushFTP Unprotected Alternate Channel Vulnerability

Mô tả

Tham khảo

• bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers · Press/Media Coverage
• crushftp.com/crush11wiki/Wiki.jsp · Vendor Advisory
• rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild · Press/Media Coverage
• vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability · Third Party Advisory
• vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2025-54309

Lỗ hổng khác của crushftp

• CVE-2025-63419TRUNG BÌNH 6.1Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature …
• CVE-2025-63420TRUNG BÌNH 4.1CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling pe…
• CVE-2025-32103TRUNG BÌNH 5.0CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files ac…
• CVE-2025-32102TRUNG BÌNH 5.0CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request …
• CVE-2025-31161NGHIÊM TRỌNG 9.8ĐANG BỊ KHAI THÁC (CISA KEV)CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy insta…