PT-2023-22025 · Filerun · Filerun

Christian Pöschl · Published 2023-12-05 · Updated 2023-12-11 · CVE-2023-28875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Filerun Update 20220202

Description A Stored XSS issue in shared files download terms allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.

Recommendations For Filerun Update 20220202, consider disabling the shared files download feature until a patch is available to prevent exploitation of the Stored XSS issue. Restrict access to shared links to minimize the risk of malicious JavaScript code execution. Avoid using crafted share links in the affected Filerun version until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28875

Affected Products

Filerun

References · 8

• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0009 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28875 · Security Note
• https://filerun.com/changelog · Note
• https://t.me/cvenotify/62514 · Telegram Post
• https://twitter.com/CVEnew/status/1732219934673924166 · Twitter Post
• https://t.me/cvenotify/63226 · Telegram Post
• https://t.me/cvenotify/62429 · Telegram Post