filecloud 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk csrf and パス処理の欠陥 があり、vendor surface software deployment and vendor surface production workloads の利用場面で ファイル上書き などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2022-39833 | FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request. | [email protected] | 7.2 | 9.55% | 2022-11-23 | 2025-04-25 |
| CVE-2022-1958 | A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960. | [email protected] | 6.3 | 0.23% | 2022-06-15 | 2024-11-21 |
| CVE-2022-24633 | All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths. | [email protected] | 5.3 | 0.24% | 2022-02-24 | 2024-11-21 |
| CVE-2022-25242 | In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). | [email protected] | 8.8 | 0.14% | 2022-02-16 | 2024-11-21 |
| CVE-2022-25241 | In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). | [email protected] | 8.8 | 1.22% | 2022-02-16 | 2024-11-21 |
| CVE-2020-26524 | CodeLathe FileCloud before 20.2.0.11915 allows username enumeration. | [email protected] | 5.3 | 0.46% | 2020-10-02 | 2024-11-21 |
| CVE-2016-6578 | CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. | [email protected] | 8.8 | 0.10% | 2018-07-13 | 2024-11-21 |