CVE-2015-20129
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Risk Assessment
An attacker can leverage the administrator's session to create a root-level account or change server configuration, leading to full system compromise. The risk is critical because it only requires luring an administrator to a malicious page.
Recommendation
Update CrushFTP to version 7.3.0 or later. Until updated, enable CSRF protection if available and restrict administrative access to trusted networks.
Other vulnerabilities in CrushFTP
See all- CVE-2025-54309CriticalActively exploited
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
- CVE-2025-31161CriticalActively exploited
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025. The vulnerability is a race condition in the AWS4-HMAC (S3-compatible) authorization method of the HTTP component. The server first verifies user existence via login_user_pass() without password, authenticating the session through HMAC verification. Sending a mangled AWS4-HMAC header stabilizes the attack, causing an index-out-of-bounds error that prevents session cleanup.
- CVE-2017-14035Critical
CrushFTP versions 8.x before 8.2.0 have a serialization vulnerability.
Original NVD description (English source)
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS