id: GO-ID-PENDING
modules:
    - module: github.com/drakkan/sftpgo
      non_go_versions:
        - fixed: 2.3.5
      vulnerable_at: 1.2.2
summary: SFTPGo WebClient vulnerable to Cross-site Scripting in github.com/drakkan/sftpgo
description: |-
    ### Impact Cross-site scripting (XSS) vulnerabilities have been reported to
    affect SFTPGo WebClient. If exploited, this vulnerability allows remote
    attackers to inject malicious code.

    ### Patches Fixed in v2.3.5.
cves:
    - CVE-2022-39220
ghsas:
    - GHSA-cf7g-cm7q-rq7f
references:
    - advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-39220
    - fix: https://github.com/drakkan/sftpgo/commit/cbef217cfa92478ee8e00ba1a5fb074f8a8aeee0
notes:
    - lint: 'description: possible markdown formatting (found ### )'
source:
    id: GHSA-cf7g-cm7q-rq7f
    created: 1999-01-01T00:00:00Z
review_status: UNREVIEWED