CVE-2017-14035
CriticalSummary
CrushFTP versions 8.x before 8.2.0 have a serialization vulnerability.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to data or execution of malicious code.
Recommendation
It is recommended to upgrade CrushFTP to version 8.2.0 or later to mitigate this vulnerability.
Other vulnerabilities in CrushFTP
See all- CVE-2025-54309CriticalActively exploited
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
- CVE-2025-31161CriticalActively exploited
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025. The vulnerability is a race condition in the AWS4-HMAC (S3-compatible) authorization method of the HTTP component. The server first verifies user existence via login_user_pass() without password, authenticating the session through HMAC verification. Sending a mangled AWS4-HMAC header stabilizes the attack, causing an index-out-of-bounds error that prevents session cleanup.
- CVE-2015-20129High
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Original NVD description (English source)
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS