PT-2018-15195 · Pydio · Pydio

Mike Gualtieri · Publicado 2018-07-23 · Atualizado 2018-09-19 · CVE-2018-1999016

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pydio versions 8.2.0 and earlier

Description The issue is related to a Cross Site Scripting (XSS) vulnerability that can be exploited by an unauthenticated remote attacker. This can result in the manipulation of the web client via XSS code injection when a victim opens a specially crafted URL. The vulnerability is located in specific files, including ./core/vendor/meenie/javascript-packer/example-inline.php and ./core/vendor/dapphp/securimage/examples/test.mysql.static.php.

Recommendations For Pydio versions 8.2.0 and earlier, update to version 8.2.1 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1999016

Produtos afetados

Pydio

Referências · 4

• 🔥 https://mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999016 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999016 · Aviso do Fabricante
• https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release · Aviso do Fabricante