PT-2021-10816 · Unknown · Folder Lock

Published 2021-10-22 · Updated 2021-10-27 · CVE-2020-23039

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Folder Lock version 3.4.5

Description A stored cross-site scripting issue was found in the Create Folder function under the 'create' module. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name.

Recommendations For version 3.4.5, consider disabling the Create Folder function under the 'create' module until a patch is available to prevent exploitation. Restrict access to the 'create' module to minimize the risk of arbitrary script execution. Avoid using crafted payloads as path or folder names in the affected function.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23039

Affected Products

Folder Lock

References · 3

• 🔥 https://vulnerability-lab.com/get_content.php?id=2210 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23039 · Security Note