1. Home
  2. CVE Database
  3. CVE-2021-44076
MEDIUM · 4.8

CVE-2021-44076

An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-...

Vulnerability Description

An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.

CVSS Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
CrushftpCrushftp>= 9.0.0, < 9.4.0_15

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-44076?

CVE-2021-44076 is a vulnerability with a CVSS score of 4.8 (MEDIUM). An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-...

How severe is CVE-2021-44076?

CVE-2021-44076 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-44076?

Check the references section above for vendor advisories and patch information. Affected products include: Crushftp Crushftp.