GitHub Advisoryadvisory · Go

GHSA-pwq7-f7f9-cm2j Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload

MEDIUM Published 2022-09-30 Modified 2022-10-04 Official page ↗
Aliases
CVE-2022-40931
Ecosystem
Go
Packages
github.com/dutchcoders/transfer.sh
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-10-01

Affected packages

• Go github.com/dutchcoders/transfer.sh: <= 1.4.0 (no fix yet)

Description

dutchcoders Transfer.sh versions 1.4.0 and prior are vulnerable to Cross Site Scripting (XSS) via a malicious document uploaded in transfer.sh. There is a fix commit merged into main for this issue, but an updated version has not yet been released.

Related

Alias · CVE (1)

  • CVE-2022-40931 dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References