PT-2022-17172 · Filecloud · Filecloud

Published 2022-02-16 · Updated 2022-02-24 · CVE-2022-25241

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileCloud versions prior to 21.3

Description The CSV user import functionality in FileCloud is vulnerable to Cross-Site Request Forgery (CSRF). This issue allows an attacker to perform unauthorized actions on the application.

Recommendations For versions prior to 21.3, update to version 21.3 or later to resolve the issue. As a temporary workaround, consider disabling the CSV user import functionality until a patch is available. Restrict access to the import feature to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-25241

Affected Products

Filecloud

References · 10

• 🔥 http://packetstormsecurity.com/files/166074/FileCloud-21.2-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/50774 · Exploit
• https://osv.dev/vulnerability/CVE-2022-25241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25241 · Security Note
• https://filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation · Vendor Advisory
• https://t.me/cvenotify/26849 · Telegram Post
• https://t.me/cibsecurity/37556 · Telegram Post
• https://t.me/cvenotify/27141 · Telegram Post
• https://t.me/cvenotify/27237 · Telegram Post
• https://herolab.usd.de/security-advisories · Note