CVE-2019-10047 PyDio Stored XSS Vulnerability

What is CVE-2019-10047?

CVE-2019-10047 is a medium-severity cross-site scripting vulnerability in n/a, published on 31 May 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application, and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser, then the included JavaScript code is executed under the context of the victim user session.

Weakness: CWE-79

Which versions are affected by CVE-2019-10047?

3 open source packages ship an affected version, including pydio. It affects 1 product.

Products include Pydio Pydio.

How do I fix CVE-2019-10047?

No fix has been published for CVE-2019-10047 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-10047 being exploited?

There is no known exploitation of CVE-2019-10047 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-4267 Command injection in Ajaxeplorer Critical 9.8
• CVE-2019-9642 Code injection in n/a Critical 9.8
• CVE-2018-20718 Deserialization in n/a Critical 9.8
• CVE-2015-3431 Command injection in n/a Critical 9.8
• CVE-2019-20452 Deserialization in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5ghg-233h-7j79, PYSEC-2026-902.