PT-2021-20158 · Dutchcoders · Transfer.Sh

Ryotak · Published 2021-05-24 · Updated 2024-08-21 · CVE-2021-33496

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dutchcoders transfer.sh versions prior to 1.2.4

Description The issue allows cross-site scripting (XSS) via an inline view. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the compromised page.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the inline view feature until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33496

GHSA-W3JX-WV97-67PH

GO-2022-0924

Affected Products

Transfer.Sh

References · 10

• https://github.com/dutchcoders/transfer.sh/pull/373 · Patch
• https://github.com/dutchcoders/transfer.sh/commit/9df18fdc69de2e71f30d8c1e6bfab2fda2e52eb4 · Patch
• https://osv.dev/vulnerability/GO-2022-0924 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w3jx-wv97-67ph · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33496 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33496 · Vendor Advisory
• https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4 · Note
• https://t.me/cvenotify/14915 · Telegram Post
• https://vuln.ryotak.me/advisories/43 · Note
• https://github.com/advisories/GHSA-w3jx-wv97-67ph · Note