PT-2021-15525 · Unknown · File-Upload-With-Preview

Michele Di Stefano · Published 2021-09-05 · Updated 2024-03-26 · CVE-2021-23439

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions file-upload-with-preview versions prior to 4.2.0

Description The issue allows a file containing malicious JavaScript code in its name to be uploaded, but this requires a user to be tricked into uploading such a file.

Recommendations For versions prior to 4.2.0, update to version 4.2.0 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-23439

GHSA-97PV-4338-R5VP

SNYK-JS-FILEUPLOADWITHPREVIEW-1579492

Affected Products

File-Upload-With-Preview

References · 9

• https://github.com/johndatserakis/file-upload-with-preview/pull/40/files?file-filters%5B%5D=.js&hide-deleted-files=true%23diff-fe47b243de17419c0daa22cd785cd754baed60cf3679d3da1d6fe006f9f4a7f0R174 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23439 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23439 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-97pv-4338-r5vp · Vendor Advisory
• https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-upload-with-preview.js%23L168 · Note
• https://github.com/johndatserakis/file-upload-with-preview · Note
• https://t.me/cibsecurity/28267 · Telegram Post
• https://t.me/cvenotify/20671 · Telegram Post
• https://snyk.io/vuln/SNYK-JS-FILEUPLOADWITHPREVIEW-1579492 · Note