Credentials Theft Vulnerability in CrushFTP by CrushFTP, Inc.
CVE-2018-18288

6.1MEDIUM

Key Information:

Vendor
Crushftp
Status
Crushftp
Vendor
CVE Published:
26 December 2019

Summary

CrushFTP versions prior to 8.3.0 are susceptible to a vulnerability that enables attackers to steal user credentials through URL redirection. This security flaw could allow malicious actors to manipulate redirection patterns, potentially leading to unauthorized access and data breaches. Organizations using vulnerable versions must update promptly to safeguard against this exploit.

References

https://www.crushftp.com/version8_build.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.