Threats tagged 'ghsa-4p7q-hmcp-j657'

CrushFTP versions 9.x, 10.x through 10.8.4, and 11.x through 11.3.1 contain a server-side request forgery (SSRF) vulnerability. This flaw exists in the handling of the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI. The vulnerability allows an attacker with low privileges to induce the server to make arbitrary network requests. The CVSS 3.1 base score is 5.0, indicating a medium severity issue with low attack complexity and no user interaction required.