Authorization

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be use...

CVE-2023-2979

CVE-2023-2979 affects Abstrium Pydio Cells 4.2.0, specifically the User Creation Handler component. The issue enables improper access controls, with a remote-initiated attack described across multiple sources. The exploit has been disclosed publicly, and upgrading to version 4.2.1 is the document...

CVE-2023-2979 Abstrium Pydio Cells User Creation access control

A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2023-2978 Abstrium Pydio Cells Change Subscription authorization

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be use...

CVE-2023-2978

CVE-2023-2978 affects Abstrium Pydio Cells 4.2.0, with the Change Subscription Handler component enabling an authorization bypass. Multiple sources confirm the issue and state that upgrading to v4.2.1 addresses the vulnerability. The vulnerability is described consistently across sources, noting ...

PT-2023-22418 · Abstrium · Abstrium Pydio Cells

Name of the Vulnerable Software and Affected Versions: Abstrium Pydio Cells version 4.2.0 Description: A critical issue has been found in the User Creation Handler component, leading to improper access controls. The attack can be initiated remotely. Upgrading to version 4.2.1 addresses this issue...

Pydio Cells 4.1.2 Server-Side Request Forgery

For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a...

Abstrium Pydio Cells 访问控制错误漏洞

Abstrium Pydio Cells is a next-generation file sharing platform developed using the Go language by Abstrium France. An Access Control Error vulnerability exists in Abstrium Pydio Cells version 4.2.0, which stems from incorrect access control...

Pydio Cells 4.1.2 Privilege Escalation

Advisory: Pydio Cells: Unauthorised Role Assignments Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assignin...

PT-2023-22416 · Abstrium · Abstrium Pydio Cells

Name of the Vulnerable Software and Affected Versions: Abstrium Pydio Cells version 4.2.0 Description: A vulnerability was found in the component Change Subscription Handler, which leads to authorization bypass. The manipulation of this component can be exploited, and it has been disclosed to the...

Pydio Cells 4.1.2 Cross Site Scripting

Advisory: Pydio Cells: Cross-Site Scripting via File Download Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript 1. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web...

PT-2023-23997 · Pydio · Pydio Cells

Name of the Vulnerable Software and Affected Versions: Pydio Cells affected versions not specified Description: The issue allows users to assign arbitrary roles to newly created external users by modifying the HTTP request during the creation process. This can grant access to all cells and...

Abstrium Pydio Cells 安全漏洞

Abstrium Pydio Cells is a next-generation file-sharing platform developed using the Go language by French company Abstrium. A security vulnerability exists in Abstrium Pydio Cells version 4.2.0. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

Abstrium Pydio Cells 安全漏洞

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by French company Abstrium. A security vulnerability exists in Abstrium Pydio Cells version 4.2.0, which stems from an incorrect operation of the application resulting in an authorization bypass...

Abstrium Pydio Cells 安全漏洞

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by French company Abstrium. A security vulnerability exists in Abstrium Pydio Cells version 4.2.0 that stems from improper control of resource identifiers...

Pydio 跨站脚本漏洞

Pydio AjaXplorer is a web-based remote file manager from Pydio. The manager supports uploading and downloading files, online file editing, image previewing, and more. A security vulnerability exists in Pydio version 4.2.3, which can be exploited by an attacker to cause a cross-site scripting...

GHSA-5GHG-233H-7J79 PyDio Stored XSS Vulnerability

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

PyDio Stored XSS Vulnerability

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

CVE-2021-41324

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...

CVE-2021-41324

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...