CVE-2017-14037

Published: Aug 30, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.

Affected (5)

Products: Crushftp: Crushftp

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Crushftp Crushftp	Up to 7.7.0
Crushftp Crushftp	Version 8.0.2
Crushftp Crushftp	Version 8.0.3
Crushftp Crushftp	Version 8.0.4
Crushftp Crushftp	Version 8.1.0

Related CWEs

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (4)

https://crushftp.com/version7.html

Source: cve@mitre.org

Vendor Advisory

https://crushftp.com/version8.html

Source: cve@mitre.org

Vendor Advisory

https://crushftp.com/version7.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://crushftp.com/version8.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.