Crushftp CVE-2017-14037

MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2017-08-30 cve@mitre.org

Information Disclosure Crushftp

6.1

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Aug 30, 2017 - 21:29 cve.org

MEDIUM 6.1

DescriptionCVE.org

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.

AnalysisAI

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-93. CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. Affected products include: Crushftp. Version information: before 7.8.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Crushftp

View all

CVE-2025-31161 CRITICAL Emergency POC

CrushFTP 10 and 11 contain an authentication bypass allowing takeover of the crushadmin account through a race condition

CVE-2023-48795 MEDIUM This Month POC

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

CVE-2023-43177 CRITICAL Emergency POC

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVE-2024-4040 CRITICAL Act Now POC

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all

CVE-2017-14035 CRITICAL Act Now

CrushFTP 8.x before 8.2.0 has a serialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r

CVE-2024-53552 CRITICAL Act Now

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. Rated critical se

CVE-2025-32103 MEDIUM This Month POC

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/

CVE-2025-32102 MEDIUM This Month POC

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=t

CVE-2017-14036 MEDIUM This Month

CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp

CVE-2017-14038 MEDIUM This Month

CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerab

CVE-2024-22910 MEDIUM This Month

Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code

CVE-2025-63419 MEDIUM This Month POC

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. Rated medium severity (CVSS 6.1), this vulnerability is

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all

CVE-2016-3115 MEDIUM POC

CVE-2021-39172 HIGH POC

CVE-2026-23953 HIGH POC

CVE-2024-45302 HIGH POC

CVE-2017-5868 MEDIUM POC

CVE-2026-21428 HIGH POC

CVE-2022-0666 HIGH POC

CVE-2019-10678 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2017-14037 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy