彙總 filecloud 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 CSRF與路徑處理缺陷，在 軟體部署與生產負載 使用場景中可能帶來 檔案覆寫 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2022-39833 | FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request. | [email protected] | 7.2 | 2.62% | 2022-11-23 | 2025-04-25 |
| CVE-2022-1958 | A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960. | [email protected] | 6.3 | 0.68% | 2022-06-15 | 2024-11-21 |
| CVE-2022-24633 | All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths. | [email protected] | 5.3 | 0.78% | 2022-02-24 | 2024-11-21 |
| CVE-2022-25242 | In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). | [email protected] | 8.8 | 0.37% | 2022-02-16 | 2024-11-21 |
| CVE-2022-25241 | In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). | [email protected] | 8.8 | 3.27% | 2022-02-16 | 2024-11-21 |
| CVE-2020-26524 | CodeLathe FileCloud before 20.2.0.11915 allows username enumeration. | [email protected] | 5.3 | 1.42% | 2020-10-02 | 2024-11-21 |
| CVE-2016-6578 | CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. | [email protected] | 8.8 | 0.87% | 2018-07-13 | 2024-11-21 |