Skip to main content

Crushftp CVE-2024-53552

CRITICAL
Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
2024-12-10 cve@mitre.org
Information Disclosure Crushftp
9.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 10, 2024 - 02:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

AnalysisAI

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-640. CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. Affected products include: Crushftp. Version information: before 10.8.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Crushftp

View all
CVE-2025-31161 CRITICAL POC
9.8 Apr 03

CrushFTP 10 and 11 contain an authentication bypass allowing takeover of the crushadmin account through a race condition
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2023-43177 CRITICAL POC
9.8 Nov 18

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2024-4040 CRITICAL POC
10.0 Apr 22

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
CVE-2017-14035 CRITICAL
9.8 Aug 30

CrushFTP 8.x before 8.2.0 has a serialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2025-32103 MEDIUM POC
5.0 Apr 15

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/

CVE-2025-32102 MEDIUM POC
5.0 Apr 15

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=t
CVE-2017-14037 MEDIUM
6.1 Aug 30

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. Rated medium severity (CVSS 6.1), this vuln
CVE-2017-14036 MEDIUM
6.1 Aug 30

CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2017-14038 MEDIUM
6.1 Aug 30

CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerab
CVE-2024-22910 MEDIUM
6.1 May 14

Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code

CVE-2025-63419 MEDIUM POC
6.1 Nov 12

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. Rated medium severity (CVSS 6.1), this vulnerability is

Same weakness CWE-640 – Weak Password Recovery Mechanism for Forgotten Password

View all
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-7615 HIGH POC
8.8
CVE-2017-8295 MEDIUM POC
5.9
CVE-2025-6216 CRITICAL POC
9.8
CVE-2025-47646 CRITICAL POC
9.8
CVE-2015-7257 HIGH POC
7.5
CVE-2022-50910 CRITICAL POC
9.8
CVE-2026-12417 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-53552 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy