CVE-2022-39833

Published: Nov 23, 2022Modified: Apr 25, 2025

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.

Affected (1)

Products: Filecloud: Filecloud

Filecloud

1 product

Filecloud

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Filecloud Filecloud	From 20.2 to 21.3.7.18607

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://gist.github.com/DylanGrl/4b4e0d53bb7626b2ab3f834ec5a2b23c

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/2022-security-advisories/advisory-2022-10-01-unauthorized-access-and-potential-remote-code-execution

Source: cve@mitre.org

Vendor Advisory

https://gist.github.com/DylanGrl/4b4e0d53bb7626b2ab3f834ec5a2b23c

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/2022-security-advisories/advisory-2022-10-01-unauthorized-access-and-potential-remote-code-execution

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.