Stored XSS Vulnerability in Croogo File Manager
CVE-2019-7173

4.8MEDIUM

Key Information:

Vendor

Croogo

Status
Croogo
Vendor
CVE Published:
29 January 2019

What is CVE-2019-7173?

A stored Cross-Site Scripting (XSS) vulnerability exists in Croogo versions up to 3.0.5, specifically within the Title field of the file manager's attachment editing page. An attacker can exploit this flaw to inject malicious HTML or JavaScript code, which could be executed in the context of an unsuspecting user's session, potentially leading to data theft or other malicious activities.

References

https://github.com/croogo/croogo/issues/889
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.
CVE-2019-7173 : Stored XSS Vulnerability in Croogo File Manager