Vulnerability Details CVE-2024-25155
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.6%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2024-25155
-
cpe:2.3:a:fortra:filecatalyst_direct:3.0.0
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.1
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.2
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.4
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.5
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.6
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.7
-
cpe:2.3:a:fortra:filecatalyst_direct:3.8.8