CVE-2023-38501
Medium
Description
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
SeverityMedium
CVSS6.3
Exploit probability—
Product9001 Copyparty
PublishedJul 25, 2023
First seenJul 25, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- 9001 copyparty1.8.7 or later
- copyparty1.8.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 9001 copyparty | v < 1.8.7 | 1.8.7 |
| copypartyPyPI | v < 1.8.7 | 1.8.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.