View Attach (1) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
jpg
 minor_update.jpg 356.6 kB 1 05-Dec-2023 05:32 Ada Csaba

This page (revision-62) was last changed on 02-Apr-2025 03:23 by Ben Spink

This page was created on 05-Dec-2023 05:32 by Ben Spink

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 2 changed one line
If your CrushFTP is lower than 10.5.5, you are vulnerable to an exploit that was responsibly disclosed. It is not known to be in he wild, but its severe and everyone must update immediately. All versions of CrushFTP...v4/v5/v6/v7/v8/v9/v10 were affected by this. CrushFTP v11 is not affected by this as it has been patched before its first public release.\\
If your CrushFTP is lower than 10.5.5, you are vulnerable to an exploit that was responsibly disclosed. It is not known to be in he wild, but its severe and everyone must update immediately. All versions of CrushFTP...v4/v5/v6/v7/v8/v9/v10 were affected by this. CrushFTP v11 is not affected by this as it has been patched before its first public release. One part of the vulnerability allows an attacker to gain access simply by knowing the admin username, and the other parts when used together allows an attacker who has a non privileged account to gain access to files outside their VFS which can then be in turn used to login as a more privileged user.\\
At line 4 changed one line
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT AUGUST 10, 2023!
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT AUGUST 10, 2023! (CVE should be published in mid November)
At line 7 changed one line
The vulnerability CVE will be released soon. This vulnerability is critical because it does NOT require any authentication. It can be done anonymously and steal the session of other users and escalate to an administrator user. Its critical everyone updates ASAP! 10.5.2 changes other defaults related to loading DB drivers that are not in your classpath has also changed. This means if your DB drivers are not part of your plugins/lib folder, they will not be loaded by CrushFTP. (Statistics DB if you changed it, SQL Users if you are using that, etc.)\\
This vulnerability is critical because it does NOT require any authentication. It can be done anonymously and steal the session of other users and escalate to an administrator user. Its critical everyone updates ASAP! 10.5.2 changes other defaults related to loading DB drivers that are not in your classpath has also changed. This means if your DB drivers are not part of your plugins/lib folder, they will not be loaded by CrushFTP. (Statistics DB if you changed it, SQL Users if you are using that, etc.)\\
Version Date Modified Size Author Changes ... Change note
62 02-Apr-2025 03:23 5.805 kB Ben Spink to previous
61 01-Apr-2025 14:13 5.556 kB Ben Spink to previous | to last
« This page (revision-62) was last changed on 02-Apr-2025 03:23 by Ben Spink
G’day (anonymous guest)
CrushFTP11 | What's New

Referenced by
LeftMenu

JSPWiki