Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/wdormann/statuses/114279572208955935">Will Dormann (wdormann@infosec.exchange)'s status on Friday, 04-Apr-2025 21:21:29 JST</a><a href="https://infosec.exchange/@wdormann" title="wdormann@infosec.exchange"><img src="https://gnusocial.jp/avatar/232810-48-20240116185707.webp" width="48" height="48" alt="Will Dormann" style="position: absolute; left: 0; top: 0;">Will Dormann</a><div><a href="https://infosec.exchange/@wdormann/114257437962283266" rel="in-reply-to">in reply to</a></div></section><article><p>Apparently the CVE system is for bickering. 🤷♂️<br><a href="https://www.securityweek.com/details-emerge-on-cve-controversy-around-exploited-crushftp-vulnerability/" rel="nofollow">https://www.securityweek.com/details-emerge-on-cve-controversy-around-exploited-crushftp-vulnerability/</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4844107#notice-9486909">In conversation</a><time datetime="2025-04-04T21:21:29+09:00" title="Friday, 04-Apr-2025 21:21:29 JST">about 20 hours ago</time> <span>from <span><a href="https://infosec.exchange/@wdormann/114279572208955935" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@wdormann/114279572208955935">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/4413848">VulnCheck has been a CVE Numbering Authority (CNA) since April 2023 and it is allowed to assign CVE identifiers to vulnerabilities found in software that is not specifically covered by other CNAs. However, CrushFTP was not happy with the decision, arguing that the “real CVE” had been pending. Indeed, roughly 10 days after disclosure, CrushFTP told SecurityWeek that the CVE for this vulnerability is CVE-2025-31161, which was assigned by Outpost24, the security firm credited for responsibly disclosing the flaw to the vendor.</a></label><br><a href="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/279/568/311/468/701/original/c44506e0803e839c.jpeg" rel="external">https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/279/568/311/468/701/original/c44506e0803e839c.jpeg</a></li><li><article><header><div>Domain not in remote thumbnail source whitelist: www.securityweek.com</div><h5><a href="https://www.securityweek.com/details-emerge-on-cve-controversy-around-exploited-crushftp-vulnerability/">Two CVEs, One Critical Flaw: Inside the CrushFTP Vulnerability Controversy</a></h5><div> from <span>@https://twitter.com/EduardKovacs</span></div></header><div>Two CVEs now exist for an actively exploited CrushFTP vulnerability and much of the security industry is using the ‘wrong one’.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Will Dormann (wdormann@infosec.exchange)'s status on Friday, 04-Apr-2025 21:21:29 JST Will Dormann
in reply to
Apparently the CVE system is for bickering. 🤷♂️
https://www.securityweek.com/details-emerge-on-cve-controversy-around-exploited-crushftp-vulnerability/
In conversationabout 20 hours ago from infosec.exchangepermalink
Attachments
1. VulnCheck has been a CVE Numbering Authority (CNA) since April 2023 and it is allowed to assign CVE identifiers to vulnerabilities found in software that is not specifically covered by other CNAs. However, CrushFTP was not happy with the decision, arguing that the “real CVE” had been pending. Indeed, roughly 10 days after disclosure, CrushFTP told SecurityWeek that the CVE for this vulnerability is CVE-2025-31161, which was assigned by Outpost24, the security firm credited for responsibly disclosing the flaw to the vendor.
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/279/568/311/468/701/original/c44506e0803e839c.jpeg
2. Domain not in remote thumbnail source whitelist: www.securityweek.com
  Two CVEs, One Critical Flaw: Inside the CrushFTP Vulnerability Controversy
  from @https://twitter.com/EduardKovacs
  Two CVEs now exist for an actively exploited CrushFTP vulnerability and much of the security industry is using the ‘wrong one’.

Public

Embed Notice

HTML Code

Corresponding Notice