What is GHSA-cf7g-cm7q-rq7f?

GHSA-cf7g-cm7q-rq7f is a security advisory published by GitHub Security Advisories with Medium severity. SFTPGo WebClient vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-cf7g-cm7q-rq7f cover?

GHSA-cf7g-cm7q-rq7f covers the following CVE IDs: CVE-2022-39220. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cf7g-cm7q-rq7f?

GHSA-cf7g-cm7q-rq7f has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-cf7g-cm7q-rq7f?

GHSA-cf7g-cm7q-rq7f affects 1 product, including: go/github.com/drakkan/sftpgo:\u003c 2.3.5.

GHSA-cf7g-cm7q-rq7fMediumCVSS 6.1

SFTPGo WebClient vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

September 20, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-39220 →

📋 Description

Impact

Cross-site scripting (XSS) vulnerabilities have been reported to affect SFTPGo WebClient. If exploited, this vulnerability allows remote attackers to inject malicious code.

Patches

Fixed in v2.3.5.

🎯 Affected products1

go/github.com/drakkan/sftpgo:< 2.3.5

🔗 References (4)

https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f
https://github.com/drakkan/sftpgo/commit/cbef217cfa92478ee8e00ba1a5fb074f8a8aeee0
https://nvd.nist.gov/vuln/detail/CVE-2022-39220
https://github.com/advisories/GHSA-cf7g-cm7q-rq7f