CVE-2022-32167: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

September 21, 2022 (updated September 23, 2022)

Cloudreve versions v1.0.0 through v3.5.3 is vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.

References

github.com/advisories/GHSA-fg25-gq9g-32mx
nvd.nist.gov/vuln/detail/CVE-2022-32167
www.mend.io/vulnerability-database/CVE-2022-32167

Code Behaviors & Features

Detect and mitigate CVE-2022-32167 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →