PT-2020-9727 · Seeftl+1 · Seeftl+1

Published 2020-01-06 · Updated 2020-04-01 · CVE-2019-15603

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions seefl version 0.1.1 seeftl versions (affected versions not specified)

Description The issue concerns a stored Cross-Site Scripting (XSS) vulnerability. It occurs when a malicious filename is rendered in a directory listing, allowing attackers to execute arbitrary JavaScript in the victim's browser. The vulnerability is caused by the failure to sanitize filenames.

Recommendations For seefl version 0.1.1, consider using an alternative package until a fix is made available. For seeftl, consider using an alternative package until a fix is made available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15603

GHSA-4G46-5GRC-WQ49

Affected Products

Seefl

Seeftl

References · 5

• 🔥 https://hackerone.com/reports/665302 · Exploit
• https://osv.dev/vulnerability/GHSA-4g46-5grc-wq49 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15603 · Security Note
• https://npmjs.com/advisories/1451 · Note