In short
- CVE-2022-39220 is a MEDIUM (CVSS 6.1) vulnerability affecting github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project).
- Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.5% of all vulnerabilities.
- Fix: update to 2.3.5 or later.
Description
Impact
Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.
Patches
Fixed in v2.3.5.
NVD description
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
More vulnerabilities in github.com/drakkan/sftpgo
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free