PT-2020-20666 · Gwtupload · Gwtupload

Uzakovo · Published 2020-02-28 · Updated 2021-12-21 · CVE-2020-9447

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GwtUpload version 1.0.3

Description The issue concerns a cross-site scripting (XSS) vulnerability in the file upload functionality. This vulnerability allows an attacker to upload a file with a malicious filename containing JavaScript code, resulting in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a website, and perform other malicious activities.

Recommendations For GwtUpload version 1.0.3, consider validating and sanitizing filenames before processing them to prevent the execution of malicious JavaScript code. As a temporary workaround, restrict the file upload feature until a proper fix is implemented.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-9447

GHSA-5CHJ-XPRR-7QQX

Affected Products

Gwtupload

References · 8

• 🔥 https://github.com/manolo/gwtupload/issues/32 · Exploit
• 🔥 https://coresecurity.com/advisories/gwtupload-xss-file-upload-functionality · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9447 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9447 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5chj-xprr-7qqx · Vendor Advisory
• https://github.com/manolo/gwtupload · Note
• https://t.me/cvenotify/1278 · Telegram Post
• https://t.me/cvenotify/24691 · Telegram Post