9.6
CVE-2024-11986
- EPSS 0.95%
- Published 13.12.2024 14:15:21
- Last modified 13.12.2024 14:15:21
- Source a6d3dc9e-0591-4a13-bce7-0f5b31
- Teams watchlist Login
- Open Login
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorCrushFTP, LLC
≫
Product
CrushFTP
Default Statusunaffected
Version <
10.8.2
Version
10.0.0
Status
affected
Version <
11.2.1
Version
11.0.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.95% | 0.755 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 | 9.6 | 2.8 | 6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.