CVE-2017-17933

cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2017-12-29

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Surgeftp (Netwin)

References

• https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.html