PT-2018-15195 · Pydio · Pydio

Mike Gualtieri · Published 2018-07-23 · Updated 2018-09-19 · CVE-2018-1999016

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pydio versions 8.2.0 and earlier

Description The issue is related to a Cross Site Scripting (XSS) vulnerability that can be exploited by an unauthenticated remote attacker. This can result in the manipulation of the web client via XSS code injection when a victim opens a specially crafted URL. The vulnerability is located in specific files, including ./core/vendor/meenie/javascript-packer/example-inline.php and ./core/vendor/dapphp/securimage/examples/test.mysql.static.php.

Recommendations For Pydio versions 8.2.0 and earlier, update to version 8.2.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1999016

Affected Products

Pydio

References · 4

• 🔥 https://mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999016 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1999016 · Vendor Advisory
• https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release · Vendor Advisory