| id: GO-TEST-ID |
| modules: |
| - module: github.com/drakkan/sftpgo |
| versions: |
| - fixed: 2.3.5 |
| summary: SFTPGo WebClient vulnerable to Cross-site Scripting |
| description: |- |
| ### Impact Cross-site scripting (XSS) vulnerabilities have been reported to |
| affect SFTPGo WebClient. If exploited, this vulnerability allows remote |
| attackers to inject malicious code. |
| |
| ### Patches Fixed in v2.3.5. |
| cves: |
| - CVE-2022-39220 |
| ghsas: |
| - GHSA-cf7g-cm7q-rq7f |
| references: |
| - advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-39220 |
| - fix: https://github.com/drakkan/sftpgo/commit/cbef217cfa92478ee8e00ba1a5fb074f8a8aeee0 |
| notes: |
| - lint: 'github.com/drakkan/sftpgo: version 2.3.5 does not exist' |
| - lint: references should contain at most one advisory link |
