Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-40359

Quick assessment

Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Google KFM是美国谷歌（Google）公司的一个 ajax 文件浏览器和管理器。 Google KFM 存在安全漏洞，该漏洞源于通过对 /kfm/index.php 的精心制作的 GET 请求，可以触发跨站脚本 (XSS)漏洞。

AI Predicted 5.4 Difficulty: Easy EPSS 1.82% · P78

Public Exploits 1

Nuclei · 1 CVE-2022-40359.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-40359

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Google KFM 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google KFM是美国谷歌（Google）公司的一个 ajax 文件浏览器和管理器。 Google KFM 存在安全漏洞，该漏洞源于通过对 /kfm/index.php 的精心制作的 GET 请求，可以触发跨站脚本 (XSS)漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2022-40359

# POC Description Source Link Shenlong Link
1 Kae's File Manager through 1.4.7 contains a cross-site scripting vulnerability via a crafted GET request to /kfm/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40359.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-40359

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2022-40359 (1)

Other References for CVE-2022-40359 (1)

Same Patch Batch · n/a · 2022-09-23 · 79 CVEs total

CVE-2022-35246 Rocket.Chat 安全漏洞
CVE-2022-35248 Rocket.Chat 授权问题漏洞
CVE-2022-32220 Rocket.Chat 信息泄露漏洞
CVE-2022-35250 Rocket.Chat 安全漏洞
CVE-2022-35251 Rocket.Chat 跨站脚本漏洞
CVE-2022-35249 Rocket.Chat 信息泄露漏洞
CVE-2022-35893 Insyde InsydeH2O 输入验证错误漏洞
CVE-2022-40358 Pydio 跨站脚本漏洞
CVE-2022-36338 Insyde InsydeH2O 安全漏洞
CVE-2022-35099 SWFTools 缓冲区错误漏洞
CVE-2022-32218 Rocket.Chat 信息泄露漏洞
CVE-2022-32226 Rocket.Chat 输入验证错误漏洞
CVE-2022-32227 Rocket.Chat 信息泄露漏洞
CVE-2022-32228 Rocket.Chat 安全漏洞
CVE-2022-32229 Rocket.Chat 安全漏洞
CVE-2022-35247 Rocket.Chat 安全漏洞
CVE-2022-30124 Rocket.Chat 授权问题漏洞
CVE-2022-32211 Rocket.Chat SQL注入漏洞
CVE-2022-32217 Rocket.Chat 日志信息泄露漏洞
CVE-2022-32219 Rocket.Chat 信息泄露漏洞

Showing top 20 of 79 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2022-40359

No comments yet

Leave a comment