// For flags

CVE-2022-39220

XSS Vulnerabilities in WebClient

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

SFTPGo es un servidor SFTP escrito en Go. Las versiones anteriores a 2.3.5, están sujetas a vulnerabilidades de tipo Cross-site scripting (XSS) en el SFTPGo WebClient, lo que permite a atacantes remotos inyectar código malicioso. Este problema ha sido corregido en versión 2.3.5. No se presentan mitigaciones conocidas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-09-20 CVE Published
  • 2024-04-12 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sftpgo Project
Search vendor "Sftpgo Project"
 Sftpgo
Search vendor "Sftpgo Project" for product "Sftpgo"
 < 2.3.5
Search vendor "Sftpgo Project" for product "Sftpgo" and version " < 2.3.5"
-
Affected