PT-2024-20788 · Unknown · Filecatalyst Direct

Published 2024-03-13 · Updated 2025-01-21 · CVE-2024-25155

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FileCatalyst Direct versions 3.8.6 through 3.8.8

Description The web server in FileCatalyst Direct does not properly sanitize illegal characters in a URL, which can be displayed on a subsequent error page. This allows a malicious actor to craft a URL that can execute arbitrary code within an HTML script tag.

Recommendations For versions 3.8.6 through 3.8.8, update to a version later than 3.8.8 to resolve the issue. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-25155

Affected Products

Filecatalyst Direct

References · 9

• https://fortra.com/security/advisory/fi-2024-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25155 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25155 · Vendor Advisory
• https://t.me/cvenotify/73729 · Telegram Post
• https://twitter.com/CVEnew/status/1767935424482209868 · Twitter Post
• https://t.me/true_secator/5539 · Telegram Post
• https://twitter.com/Action1corp/status/1777753710162018768 · Twitter Post
• https://t.me/cvenotify/108093 · Telegram Post
• https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html · Note