CVE-2023-38501— Copyparty 跨站脚本漏洞
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-38501の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
copyparty vulnerable to reflected cross-site scripting via k304 parameter
ソース: CVE Program / CVE List V5
脆弱性説明
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
ソース: CVE Program / CVE List V5
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: CVE Program / CVE List V5
脆弱性タイトル
Copyparty 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Copyparty是ed个人开发者的一个便携式文件服务器。 copyparty 1.8.7之前版本存在跨站脚本漏洞，该漏洞源于参数k304和setck存在反射型跨站脚本（XSS）漏洞。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2023-38501の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38501.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-38501のインテリジェンス情報
请登录查看更多情报信息。
CVE-2023-38501 补丁与修复 (1)
CVE-2023-38501 厂商安全公告 (1)
- https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hhx_refsource_CONFIRM
CVE-2023-38501 公开利用代码 (1)
IV. 関連脆弱性
同じ製品: copyparty
- CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted UR - CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully rest - CVE-2026-30974
Copyparty volflag `nohtml` did not block javascript in svg f - CVE-2026-27948
Copyparty vulnerable to eflected cross-site scripting via se - CVE-2025-58753
copyparty: Sharing a single file does not fully restrict acc
同じベンダー: 9001
- CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted UR - CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully rest - CVE-2026-30974
Copyparty volflag `nohtml` did not block javascript in svg f - CVE-2026-27948
Copyparty vulnerable to eflected cross-site scripting via se - CVE-2025-58753
copyparty: Sharing a single file does not fully restrict acc
同じ弱点: CWE-79
- CVE-2026-18988
Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Store - CVE-2026-48026
lakeFS vulnerable to stored XSS in rendered markdown preview - CVE-2026-11425
Domoticz Mobile Dashboard versions prior to 2026.3 Stored XS - CVE-2026-19230
SourceCodester Photo Share Website Comment Input Box ajax.ph - CVE-2026-64638
WordPress 4.7-7.0.2 登录页反射型XSS漏洞
V. CVE-2023-38501へのコメント
まだコメントはありません