SFTPGo WebClient vulnerable to Cross-site Scripting

GHSA-cf7g-cm7q-rq7f · CVE-2022-39220 · GO-2022-1015

Published Sep 20, 2022 · Modified Aug 21, 2024

Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

References

WEB https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-39220
WEB https://github.com/drakkan/sftpgo/commit/cbef217cfa92478ee8e00ba1a5fb074f8a8aeee0
PACKAGE https://github.com/drakkan/sftpgo

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes