Search criteria
2 vulnerabilities by copyparty_project
CVE-2023-38501 (GCVE-0-2023-38501)
Vulnerability from cvelistv5 – Published: 2023-07-25 21:06 – Updated: 2025-02-13 17:01
VLAI
Title
copyparty vulnerable to reflected cross-site scripting via k304 parameter
Summary
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/9001/copyparty/security/adviso… | x_refsource_CONFIRM |
| https://github.com/9001/copyparty/commit/007d948c… | x_refsource_MISC |
| http://packetstormsecurity.com/files/173821/Copyp… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| 9001 | copyparty |
Affected:
< 1.8.7
|
|
| copyparty_project | copyparty |
Affected:
0 , < 1.8.7
(custom)
cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:46:55.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh"
},
{
"name": "https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "copyparty",
"vendor": "copyparty_project",
"versions": [
{
"lessThan": "1.8.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38501",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T16:25:02.755347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T16:28:26.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "copyparty",
"vendor": "9001",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one\u0027s copyparty accounts, unless one have inspected one\u0027s logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-31T18:06:16.177Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh"
},
{
"name": "https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38"
},
{
"url": "http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html"
}
],
"source": {
"advisory": "GHSA-f54q-j679-p9hh",
"discovery": "UNKNOWN"
},
"title": "copyparty vulnerable to reflected cross-site scripting via k304 parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-38501",
"datePublished": "2023-07-25T21:06:18.006Z",
"dateReserved": "2023-07-18T16:28:12.077Z",
"dateUpdated": "2025-02-13T17:01:52.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-37474 (GCVE-0-2023-37474)
Vulnerability from cvelistv5 – Published: 2023-07-14 19:55 – Updated: 2025-02-13 17:01
VLAI
Title
Path traversal in copyparty
Summary
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/9001/copyparty/security/adviso… | x_refsource_CONFIRM |
| https://github.com/9001/copyparty/commit/043e3c7d… | x_refsource_MISC |
| http://packetstormsecurity.com/files/173822/Copyp… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| 9001 | copyparty |
Affected:
< 1.8.2
|
|
| copyparty_project | copyparty |
Affected:
0 , < 1.8.2
(custom)
cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:16:30.840Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg"
},
{
"name": "https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "copyparty",
"vendor": "copyparty_project",
"versions": [
{
"lessThan": "1.8.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37474",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T17:31:35.536999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T17:45:51.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "copyparty",
"vendor": "9001",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-31T18:06:31.899Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg"
},
{
"name": "https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff"
},
{
"url": "http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html"
}
],
"source": {
"advisory": "GHSA-pxfv-7rr3-2qjg",
"discovery": "UNKNOWN"
},
"title": "Path traversal in copyparty"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-37474",
"datePublished": "2023-07-14T19:55:22.779Z",
"dateReserved": "2023-07-06T13:01:36.998Z",
"dateUpdated": "2025-02-13T17:01:27.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}