En bref
- CVE-2022-39220 est une vulnérabilité MOYENNE (CVSS 6.1) touchant github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2, sftpgo (sftpgo project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.64%, plus élevée que 50.5% des vulnérabilités.
- Correctif : mettre à jour vers 2.3.5 ou plus récent.
Description
Impact
Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.
Patches
Fixed in v2.3.5.
NVD description
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
Autres vulnérabilités de github.com/drakkan/sftpgo
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free