Arbitrary File Upload Vulnerability in Alteryx Server by Alteryx
CVE-2023-26961

4.8MEDIUM

Key Information:

Vendor

Alteryx

Status
Alteryx Server
Vendor
CVE Published:
8 August 2023

What is CVE-2023-26961?

The vulnerability exists in Alteryx Server 2022.1.1.42590 due to inadequate file type verification for uploaded files. This weakness enables attackers to upload arbitrary files, including potentially harmful JavaScript code through a specific JSON document in a PUT /gallery/api/media request. Such exploits could lead to stored cross-site scripting (XSS) attacks, compromising the integrity and security of the application.

References

http://alteryx.com
https://gist.github.com/DylanGrl/4269ae834c5d0ec77c9b928a...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2023-26961 : Arbitrary File Upload Vulnerability in Alteryx Server by Alteryx