Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2022-46181

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.7%
CVSS Severity
CVSS v3 Score 6.1
Products affected by CVE-2022-46181
  • Gotify » Server » Version: 2.0.10
    cpe:2.3:a:gotify:server:2.0.10
  • Gotify » Server » Version: 2.0.11
    cpe:2.3:a:gotify:server:2.0.11
  • Gotify » Server » Version: 2.0.12
    cpe:2.3:a:gotify:server:2.0.12
  • Gotify » Server » Version: 2.0.13
    cpe:2.3:a:gotify:server:2.0.13
  • Gotify » Server » Version: 2.0.14
    cpe:2.3:a:gotify:server:2.0.14
  • Gotify » Server » Version: 2.0.15
    cpe:2.3:a:gotify:server:2.0.15
  • Gotify » Server » Version: 2.0.16
    cpe:2.3:a:gotify:server:2.0.16
  • Gotify » Server » Version: 2.0.17
    cpe:2.3:a:gotify:server:2.0.17
  • Gotify » Server » Version: 2.0.18
    cpe:2.3:a:gotify:server:2.0.18
  • Gotify » Server » Version: 2.0.19
    cpe:2.3:a:gotify:server:2.0.19
  • Gotify » Server » Version: 2.0.20
    cpe:2.3:a:gotify:server:2.0.20
  • Gotify » Server » Version: 2.0.21
    cpe:2.3:a:gotify:server:2.0.21
  • Gotify » Server » Version: 2.0.22
    cpe:2.3:a:gotify:server:2.0.22
  • Gotify » Server » Version: 2.0.23
    cpe:2.3:a:gotify:server:2.0.23
  • Gotify » Server » Version: 2.0.3
    cpe:2.3:a:gotify:server:2.0.3
  • Gotify » Server » Version: 2.0.4
    cpe:2.3:a:gotify:server:2.0.4
  • Gotify » Server » Version: 2.0.5
    cpe:2.3:a:gotify:server:2.0.5
  • Gotify » Server » Version: 2.0.6
    cpe:2.3:a:gotify:server:2.0.6
  • Gotify » Server » Version: 2.0.7
    cpe:2.3:a:gotify:server:2.0.7
  • Gotify » Server » Version: 2.0.8
    cpe:2.3:a:gotify:server:2.0.8
  • Gotify » Server » Version: 2.0.9
    cpe:2.3:a:gotify:server:2.0.9
  • Gotify » Server » Version: 2.1.0
    cpe:2.3:a:gotify:server:2.1.0
  • Gotify » Server » Version: 2.1.1
    cpe:2.3:a:gotify:server:2.1.1
  • Gotify » Server » Version: 2.1.2
    cpe:2.3:a:gotify:server:2.1.2
  • Gotify » Server » Version: 2.1.3
    cpe:2.3:a:gotify:server:2.1.3
  • Gotify » Server » Version: 2.1.4
    cpe:2.3:a:gotify:server:2.1.4
  • Gotify » Server » Version: 2.1.5
    cpe:2.3:a:gotify:server:2.1.5
  • Gotify » Server » Version: 2.1.6
    cpe:2.3:a:gotify:server:2.1.6
  • Gotify » Server » Version: 2.1.7
    cpe:2.3:a:gotify:server:2.1.7
  • Gotify » Server » Version: 2.2.0
    cpe:2.3:a:gotify:server:2.2.0
  • Gotify » Server » Version: 2.2.1
    cpe:2.3:a:gotify:server:2.2.1


Products
Pricing
Contact Us

Shodan ® - All rights reserved