I
mproper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
References
| Link | Resource |
|---|---|
| https://crushftp.com/crush11wiki/Wiki.jsp?page=Update |
Configurations
No configuration.
History
13 Dec 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-13 14:15
Updated : 2024-12-13 14:15
NVD link : CVE-2024-11986
Mitre link : CVE-2024-11986
CVE.ORG link : CVE-2024-11986
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')