CVE-2024-11986 — Stored XSS in CrushFTP

CVE-2024-11986

Stored XSS in CrushFTP PUBLISHED

Description (CNA)

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.

Affected (CNA)

Vendor / product	Versions
CrushFTP, LLC / CrushFTP	affected 10.0.0 before 10.8.2; affected 11.0.0 before 11.2.1

CWE

CWE-79

References

https://crushftp.com/crush11wiki/Wiki.jsp?page=Update

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.