Live › vulnerability › CVE-2015-20129
Go to dashboardCrushFTP before 7.3.0 ships with CSRF protection disabled by default, so admin commands can be submitted by a malicious page. An attacker who lures an authenticated administrator can create root-access users or change server configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
CrushFTP installations before 7.3.0 where an administrator uses the web admin interface while logged in. Exposure depends on whether an administrator can be lured to a malicious page while signed in. Installations that are already on 7.3.0 or later are not affected.
No product ranges from the sources yet.
7.3.07.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
This page as .md · .json · in your agent: get_signal("CVE-2015-20129")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.