An unauthenticated stored XSS vulnerability in Crafty Controller allows remote attackers to execute arbitrary scripts in the context of a user session, posing a significant risk to administrative integrity.

This is a stored cross-site scripting (XSS) flaw categorized as CWE-79, triggered by insufficient neutralization of user-supplied input within the Server MOTD component. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious scripts that execute when a victim views the modified MOTD.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of administrators, or the theft of sensitive session tokens. With a CVSS score of 7.1, this high-severity flaw represents a substantial risk to the security posture of the Crafty Controller environment, potentially leading to a full compromise of the application interface.

Immediate Action: Upgrade to Crafty Controller version 4.6.2 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application logs for anomalous MOTD update requests or unusual script tags originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS payloads and restrict access to the MOTD modification endpoint to trusted IP addresses.

Public Exploit Available: No

Given the high-severity rating and the potential for unauthorized administrative access, organizations utilizing Crafty Controller should prioritize the update to version 4.6.2. Applying this patch is the only definitive way to neutralize the XSS vector and ensure the ongoing security of the application.