Exploited vulnerability
CVE-2024-4040
TLP:CLEAR
CrushFTP VFS Sandbox Escape Vulnerability
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
Facts
- Vendor: CrushFTP
- Product: CrushFTP
- CVSS: 9.8
- EPSS (probability of exploitation within 30 days): 99.5 %
- On CISA's Known Exploited Vulnerabilities list since: 24 April 2024
- First known exploitation: 24 April 2024
- CISA's deadline for US federal agencies: 1 May 2024
- Weakness: CWE-1336
- First seen by Risk Letters: 24 April 2024
Members see which Nordic sectors the flaw hits, and what to do about it.
Get the full brief
Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD