Skip to content
OpenAdvisories
Unscored CVE-2007-3769 EUVD-2007-3753GHSA-46qf-q25w-6m5v

Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP ser…

Published Jul 15, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message. NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.

References