PT-2023-22025 · Filerun · Filerun

Christian Pöschl · Publicado 2023-12-05 · Atualizado 2023-12-11 · CVE-2023-28875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Filerun Update 20220202

Description A Stored XSS issue in shared files download terms allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.

Recommendations For Filerun Update 20220202, consider disabling the shared files download feature until a patch is available to prevent exploitation of the Stored XSS issue. Restrict access to shared links to minimize the risk of malicious JavaScript code execution. Avoid using crafted share links in the affected Filerun version until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-28875

Produtos afetados

Filerun

Referências · 8

• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0009 · Exploit
• https://filerun.com/changelog · Nota
• https://t.me/cvenotify/62514 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1732219934673924166 · Publicação no Twitter
• https://t.me/cvenotify/63226 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28875 · Aviso do Fabricante
• https://t.me/cvenotify/62429 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28875 · Nota de Segurança