CVE-2023-32751: pydio cells

csirt@kutim:~/threat-intel/cve/CVE-2023-32751

CVSS 5.4 · Medium EPSS 2,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada pydio cells. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability.

Rincian

Terbit di NVD: 8 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 2,9% peluang dieksploitasi; lebih tinggi dari 86,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pydio	cells	Semua versi sebelum 3.0.12
pydio	cells	Versi 4.1.0 hingga sebelum 4.1.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/ exploit · advisory pihak ketiga
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.