CVE-2023-2981 Abstrium Pydio Cells Chat cross site scripting

What is CVE-2023-2981?

CVE-2023-2981 is a low-severity cross-site scripting vulnerability in Abstrium Pydio Cells, published on 30 May 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.

Weakness: CWE-80

Which versions are affected by CVE-2023-2981?

4 open source packages ship an affected version, including github.com/pydio/cells and github.com/pydio/cells/v4. It affects 1 product.

Products include Abstrium Pydio Cells.

How do I fix CVE-2023-2981?

Upgrade github.com/pydio/cells to 4.2.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-2981 being exploited?

There is no known exploitation of CVE-2023-2981 in the wild and no public exploit code.

Other vulnerabilities in Abstrium Pydio Cells

• CVE-2023-2980 Abstrium Pydio Cells User Creation resource injection Medium 6.3
• CVE-2023-2979 Abstrium Pydio Cells User Creation access control Medium 4.7
• CVE-2023-2978 Abstrium Pydio Cells Change Subscription authorization Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wmfc-g86p-fjvr, GO-2023-1809.