CVE-2024-25155: Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier
Published Mar 13, 2024
·Updated
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.
Affected Software
2 affected components
FileCatalyst Direct>=3.8.6<3.8.8
Fortra Filecatalyst Direct>=3.0.0<3.8.9
Remediation
Information
Upgrade FileCatalyst to version 3.8.9 or later to remediate the XSS vulnerability.
Event History
Mar 13, 2024
CVE Published
via MITRE·02:15 PM
Data Sourced
via MITRE·02:15 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-25155?
CVE-2024-25155 is rated as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2024-25155?
To fix CVE-2024-25155, upgrade to FileCatalyst Direct version 3.8.9 or later.
3
What software is affected by CVE-2024-25155?
CVE-2024-25155 affects FileCatalyst Direct versions from 3.8.6 to 3.8.8.
4
What type of vulnerability is CVE-2024-25155?
CVE-2024-25155 is a cross-site scripting (XSS) vulnerability that involves improper URL sanitization.
5
Can CVE-2024-25155 be exploited remotely?
Yes, CVE-2024-25155 can be exploited remotely by a malicious actor crafting a specific URL.