MEDIUM5.4
GHSA-fg25-gq9g-32mx
Cross site scripting in Cloudreve
Quick fix
GHSA-fg25-gq9g-32mx — github.com/cloudreve/Cloudreve/v3: upgrade to the fixed version with the command below.
go get github.com/cloudreve/Cloudreve/v3@v3.6.0-beta1Details
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/HFO4/cloudreve
Introduced in:
1.0.0No fixed version published yet for github.com/HFO4/cloudreve (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/cloudreve/Cloudreve/v3
Introduced in:
3.0.0Fixed in: 3.6.0-beta1Fix
go get github.com/cloudreve/Cloudreve/v3@v3.6.0-beta1References
- https://nvd.nist.gov/vuln/detail/CVE-2022-32167[ADVISORY]
- https://github.com/cloudreve/Cloudreve/commit/4b85541d73949969f41ad46d1e00544c9f1a7538[WEB]
- https://github.com/cloudreve/Cloudreve[PACKAGE]
- https://github.com/cloudreve/Cloudreve/releases/tag/3.6.0-beta1[WEB]
- https://www.mend.io/vulnerability-database/CVE-2022-32167[WEB]