Vulnerabilities

TI-2022-18828 CVE-2022-39833 · GHSA-898w-r5qq-x64c

FileCloud Versions 20.2 and later allows remote attackers to potentially cause…

HIGH 67

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02889 Published 2022-11-23 No fix listed CWE-94

TI-2022-01817 CVE-2022-1958 · GHSA-hmv4-q9j9-6ccj

FileCloud NTFS access control

LOW 30

A vulnerability classified as critical has been found in FileCloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00759 Published 2022-06-15 No fix listed CWE-284

TI-2022-08466 CVE-2022-24633 · GHSA-2gqp-7qqf-5rcq

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration.

LOW 26

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00815 Published 2022-02-22 No fix listed CWE-200

TI-2022-08950 CVE-2022-25241 · GHSA-m2p4-hvh5-gh6w

In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).

MEDIUM 44

In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03271 Published 2022-02-16 No fix listed CWE-352

TI-2022-08951 CVE-2022-25242 · GHSA-7vg6-2mp7-rwr3

In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).

LOW 38

In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00385 Published 2022-02-16 No fix listed CWE-352

TI-2020-16167 CVE-2020-26524 · GHSA-hj55-99c3-hrhm

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.

LOW 27

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0144 Published 2020-10-02 No fix listed

TI-2016-05632 CVE-2016-6578 · GHSA-7c4c-w2g7-wxj4

CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF)

MEDIUM 40

CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00863 Published 2018-07-13 No fix listed CWE-352

Vulnerabilities

Filters

FileCloud Versions 20.2 and later allows remote attackers to potentially cause…

FileCloud NTFS access control

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration.

In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).

In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.

CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF)