CVE-2015-20129

EUVD-2015-9438
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.34%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
crushftpcrushftp
𝑥
< 7.3.0
CNA
Common Weakness Enumeration
References
https://www.crushftp.com/version7.html
https://www.exploit-db.com/exploits/36126
https://www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webinterface-function