CVE-2022-39833 Code injection in n/a
Remote attackers can execute arbitrary code and access API endpoints in FileCloud via crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39833?
CVE-2022-39833 is a high-severity code injection vulnerability in n/a, published on 23 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.
Weakness: CWE-94
Which versions are affected by CVE-2022-39833?
It affects 1 product.
Products include Filecloud Filecloud.
How do I fix CVE-2022-39833?
No fix has been published for CVE-2022-39833 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-39833 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39833 exists.
Other vulnerabilities in n/a
- CVE-2022-25241 Cross-site request forgery in n/a
- CVE-2022-25242 Cross-site request forgery in n/a
- CVE-2016-6578 CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF)
- CVE-2022-1958 FileCloud NTFS access control
- CVE-2022-24633 Information disclosure in n/a
Sources
Also known as GHSA-898w-r5qq-x64c.