CVE-2023-38501
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
The copyparty file server software prior to version 1.8.7 contains a reflected XSS vulnerability via URL parameters `?k304=...` and `?setck=...`. This can lead to moving or deleting existing files on the server, as well as uploading new files using the account of the person who clicks the malicious link.
Risk Assessment
The organization may lose control over its files, leading to potential data loss and security breaches. Users may be exposed to attacks that could result in unauthorized access to their accounts.
Recommendation
It is recommended to change the passwords of copyparty accounts unless logs have been inspected and no traces of attacks were found. Additionally, the software should be updated to version 1.8.7, which contains a patch for this vulnerability.
Original NVD description (English source)
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.