PT-2020-9726 · Fileview · Fileview

Published 2020-01-06 · Updated 2020-04-01 · CVE-2019-15602

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fileview versions 0.1.6 and earlier fileview (all versions)

Description The issue is related to inadequate output encoding and escaping in the fileview package, leading to a stored Cross-Site Scripting (XSS) vulnerability in files it serves. This vulnerability allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code, as the package fails to sanitize filenames.

Recommendations For fileview version 0.1.6, consider using an alternative package until a fix is made available. For all versions of fileview, consider using an alternative package until a fix is made available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15602

GHSA-GVR4-7XGC-GX3W

Affected Products

Fileview

References · 7

• 🔥 https://hackerone.com/reports/507159 · Exploit
• https://osv.dev/vulnerability/GHSA-gvr4-7xgc-gx3w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15602 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15602 · Vendor Advisory
• https://github.com/itworkcenter/fileview/pull/2 · Note
• https://github.com/itworkcenter/fileview/issues/1 · Note
• https://npmjs.com/advisories/1452 · Note