What is GHSA-vwh5-78jc-hpjx?

GHSA-vwh5-78jc-hpjx is a security advisory published by GitHub Security Advisories with Medium severity. SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

Which CVE IDs does GHSA-vwh5-78jc-hpjx cover?

GHSA-vwh5-78jc-hpjx covers the following CVE IDs: CVE-2019-14315. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwh5-78jc-hpjx?

GHSA-vwh5-78jc-hpjx has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vwh5-78jc-hpjx?

GHSA-vwh5-78jc-hpjx affects 1 product, including: composer/sunhater/kcfinder:\u003c= 3.20-test2.

GHSA-vwh5-78jc-hpjxMediumCVSS 6.1

SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 24, 2024

🔗 CVE IDs covered (1)

CVE-2019-14315 →

📋 Description

A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.

🎯 Affected products1

composer/sunhater/kcfinder:<= 3.20-test2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-14315
https://github.com/sunhater/kcfinder/issues/180
https://github.com/sunhater/kcfinder/pull/186
https://github.com/advisories/GHSA-vwh5-78jc-hpjx