PT-2022-25360 · Unknown · Ajaxplorer

Scott Sturrock · Published 2022-09-23 · Updated 2022-09-26 · CVE-2022-40358

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AjaXplorer version 4.2.3

Description An issue in AjaXplorer allows attackers to cause cross-site scripting vulnerabilities via a crafted svg file upload.

Recommendations For AjaXplorer version 4.2.3, consider restricting the upload of svg files to prevent cross-site scripting attacks until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40358

Affected Products

Ajaxplorer

References · 5

• 🔥 https://cxsecurity.com/issue/WLB-2022090059 · Exploit
• https://osv.dev/vulnerability/CVE-2022-40358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40358 · Security Note
• https://sourceforge.net/projects/ajaxplorer/files/ajaxplorer/stable-channel/4.2.3 · Note
• https://t.me/cibsecurity/50412 · Telegram Post