PT-2022-24820 · Sftpgo · Sftpgo

Drakkan · Published 2022-09-20 · Updated 2024-08-21 · CVE-2022-39220

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.3.5

Description SFTPGo is an SFTP server written in Go. The SFTPGo WebClient is subject to Cross-site scripting (XSS) vulnerabilities, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

Recommendations For versions prior to 2.3.5, update to version 2.3.5 to resolve the issue. As a temporary workaround, consider restricting access to the SFTPGo WebClient until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-39220

GHSA-CF7G-CM7Q-RQ7F

GO-2022-1015

Affected Products

Sftpgo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39220.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-39220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39220 · Security Note
• https://osv.dev/vulnerability/GHSA-cf7g-cm7q-rq7f · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1015 · Vendor Advisory
• https://github.com/drakkan/sftpgo · Note
• https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f · Note
• https://github.com/drakkan/sftpgo/commit/cbef217cfa92478ee8e00ba1a5fb074f8a8aeee0 · Note
• https://t.me/cibsecurity/50168 · Telegram Post
• https://t.me/cvenotify/36557 · Telegram Post