$ cve CVE-2023-32751 JSON

CVE-2023-32751 EXPLOIT

5.4

MEDIUM · CVSS 3.1 · EPSS 2.9% (pctl 87)

Patch early

A public exploit exists.

Description

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability.

Scoring

CVSS	5.4 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS	2.94% — more likely to be exploited than 87% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2023-06-08
Last modified	2026-06-17

Affected (1)

Vendor	Product
pydio	cells

Public exploits

Source	Title	Date
exploit-db	Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download	2023-05-31

References

→ the Explorer · watch your stack · NVD