Описание
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.
Ссылки
- Release Notes
- Vendor Advisory
- Release Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.0.0 (включая) до 3.8.9 (исключая)
cpe:2.3:a:fortra:filecatalyst_direct:*:*:*:*:*:*:*:*
EPSS
Процентиль: 77%
0.01044
Низкий
7.2 High
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79
Связанные уязвимости
CVSS3: 7.2
github
почти 2 года назад
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.
EPSS
Процентиль: 77%
0.01044
Низкий
7.2 High
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79