Detections
Analytics

SCA: security update for copyparty (GHSA-f54q-j679-p9hh)

medium Tenable Self-Hosted Container Security Plugin ID 414278

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site
 scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to
 move or delete existing files on the server, or upload new files, using the account of the person who
 clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless
 one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
 (CVE-2023-38501)

See Also

https://github.com/advisories/GHSA-f54q-j679-p9hh

Plugin Details

Severity: Medium

ID: 414278

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.07

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2023-38501

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/25/2023

Vulnerability Publication Date: 7/25/2023

Reference Information

CVE: CVE-2023-38501

cwe: CWE-79