CVE-2024-53552

Critical

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

mitre·CWE-640·Published 2024-12-10

CVSS

9.8

EPSS

0.01

KEV

Exploits

cve.orgen

102 chars

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

NVDen

102 chars

CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

NVDes

144 chars

CrushFTP 10 anterior a 10.8.3 y 11 anterior a 11.2.3 manejan incorrectamente el restablecimiento de contraseña, lo que lleva al robo de cuentas.

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.8	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	9.8	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H