CVE-2024-4040

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-04-22

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Affected Platforms (CPE)

📦

Crushftp

>= 10.0.0 and < 10.7.1>= 11.0.0 and < 11.1.0

References & Advisories

🔗 https://github.com/airbus-cert/CVE-2024-4040

🔗 https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/

🔗 https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update

🔗 https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update

🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

🔗 https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/

🔗 https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/

🔗 https://github.com/airbus-cert/CVE-2024-4040

Vulnerability Description

Affected Platforms (CPE)

Crushftp

References & Advisories

相關漏洞威脅