CVE-2024-25155

published 2024-03-13

CVE-2024-25155: In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a…

Priority P4 27 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fortra	filecatalyst	>= 3.8.6 < 3.8.9	3.8.9
fortra	filecatalyst_direct	>= 3.0.0 < 3.8.9	3.8.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79