CVE-2023-41471

HIGH

7.8

Beschreibung

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.

CVE Details

CVSS v3.1 Bewertung7.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht8/29/2025

Zuletzt geandert11/3/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

9001:copyparty

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/9001/copyparty(cve@mitre.org)

https://github.com/9001/copyparty/releases/tag/v1.9.2(cve@mitre.org)

https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/copyparty.md(cve@mitre.org)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.