Description
A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| soerennb | eXtplorer | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | extplorer | No fix yet | — |
References
- VDB-332185 | soerennb eXtplorer Filename cross site scripting vdb-entry technical-description
- VDB-332185 | CTI Indicators (IOB, IOC, TTP) signature permissions-required
- Submit #682370 | eXtplorer eXtplorer (PHP file manager) 2.1.15 Cross-Site Scripting (Stored) third-party-advisory
- https://github.com/soerennb/extplorer/issues/33 issue-tracking
- https://github.com/soerennb/extplorer/commit/002def70b985f7012586df2c44368845bf405ab3 patch
- https://github.com/soerennb/extplorer/ product