Security readout for executives and security teams
Plain-English summary
CVE-2021-44076 is a stored cross-site scripting issue in CrushFTP 9. Someone who can access the administration panel could create a user containing malicious script content that later runs in browser views. The source evidence does not show public active exploitation or a named fixed version.
Executive priority
Treat this as a targeted administrative-surface risk, not an internet-wide unauthenticated emergency based on current evidence. Prioritize if CrushFTP 9 is used for sensitive file-transfer operations or if admin access is broadly reachable.
Technical view
The issue affects CrushFTP 9 in the /WebInterface/UserManager/ new-user creation interface. It permits stored XSS by an attacker with administration panel access. The payload may execute when the affected user page appears in interface contexts such as the Most Visited section. CVSS, CWE, and fixed-version details are not provided in the source bundle.
Likely exposure
Exposure is most relevant for organizations running CrushFTP 9 where the administration panel is reachable by broad internal networks, VPN users, or the internet. Risk is lower where admin access is tightly restricted and trusted administrators are the only users with panel access.
Exploitation context
The source bundle says exploitation requires access to the administration panel. It describes stored execution in later UI scenarios, but does not provide evidence of active exploitation. The CVE is not listed as KEV in the provided data.
Researcher notes
Evidence is limited to the CVE description and referenced advisory. Missing details include CVSS, CWE, exact affected build range, fixed version, and independent exploitation confirmation. Avoid assuming broader CrushFTP versions are affected without vendor confirmation.
Mitigation direction
- Check CrushFTP vendor guidance for the fixed or recommended version.
- Restrict administration panel access to trusted networks and administrators.
- Review and reduce accounts with CrushFTP administrative privileges.
- Monitor administrative user-creation activity for suspicious entries.
- Use browser/session hygiene for administrators until remediation is confirmed.
Validation and detection
- Inventory CrushFTP deployments and identify any version 9 systems.
- Confirm whether /WebInterface/UserManager/ is reachable from untrusted networks.
- Review admin account lists and recent user-creation events.
- Check vendor release notes or support channels for CVE-specific remediation.
- Confirm compensating controls restrict administrative panel access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-44076 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.crushftp.com/CVE reference · x_refsource_MISC
- https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.