Lucene search

MitreCVE-2023-39612

HistorySep 16, 2023 - 1:15 a.m.

CVE-2023-39612

2023-09-1601:15:07

CWE-79

mitre

web.nvd.nist.gov

cve-2023-39612

cross-site scripting

xss

filebrowser

privilege escalation

security vulnerability

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.

Affected configurations

Nvd

Node

filebrowserfilebrowserRange<2.23.0

VendorProductVersionCPE
filebrowserfilebrowser*cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
filebrowser	filebrowser	*	cpe:2.3:a:filebrowser:filebrowser::::::::

References

febin0x4e4a.wordpress.com/2023/09/15/xss-in-filebrowser-leads-to-admin-account-takeover-in-filebrowser/

github.com/filebrowser/filebrowser/commit/b508ac3d4f7f0f75d6b49c99bdc661a6d2173f30

github.com/filebrowser/filebrowser/issues/2570

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Related for CVE-2023-39612