CVSS base score: 9.8 (Critical) vendor CNA · v3.1
Score assigned by the vendor's own CVE Numbering Authority (CNA); CISA's Vulnrichment program adds a score only when the CNA omits one.
Vendor: CrushFTP Product: CrushFTP
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass. Remote and unauthenticated HTTP requests to CrushFTP with known usernames can be used to impersonate a user and conduct actions on their behalf, including administrative actions and data retrieval.
Each milestone comes from a different source, so gaps between them are gaps in what those sources publish, not evidence that nothing happened. EPSS history for this CVE holds 1 point from 2025-03-29; earlier points are weekly, which dates a spike to within a week. Peak probability 12.9% on 2025-03-29.
No mentions found in monitored research blogs or news feeds.
Coverage across public collections only: Nuclei and OpenVAS NVT (scan);
Snort and Suricata ET Open (network); Sigma and YARA (host/SIEM);
Metasploit, Exploit-DB and public GitHub repositories (exploit). Absence
here means nothing public was found, not that detection is impossible.
GitHub PoC repositories are collected automatically by
PoC-in-GitHub (CC0) and are not vetted:
some are fakes and some are malware. Treat them as evidence that code was
published, not as code to run.
OpenVAS coverage derives from the Greenbone Community Feed, made available
under the Open Database License (ODbL) v1.0;
its individual Vulnerability Tests are licensed
GNU GPL v2.
Defensive techniques inferred by MITRE D3FEND from the underlying weakness (CWE-287) — general hardening and detection guidance for this weakness class, not a vendor patch for this specific CVE.
| Source | Date | Record |
|---|---|---|
| CISA Vulnrichment | 2025-03-26 | source record → |
| Date | Advisory | Issuer |
|---|---|---|
| 2025-04-03 | 2025-015: Critical vulnerability in CrushFTP | CERT-EU |
No exploit-tool sightings recorded for this CVE.
Evidence tiers are explained on the About page — a merged Metasploit module is far stronger evidence than a distro package mention.
CVE.org record → NVD entry → FortiGuard Labs → Rapid7 AttackerKB →