CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
99.7%
Filebrowser module allows site administrators to expose a particular file system folder and all of its subfolders with an FTP-like interface to site visitors.
The module doesn’t sufficiently sanitize user input when presenting lists of files.
Because the vulnerability is Reflected Cross Site Scripting, the only mitigating factor is that an authenticated user must be tricked into visiting a specially crafted malicious url.
Drupal core is not affected. If you do not use the contributed Filebrowser module, there is nothing you need to do.
Install the latest version:
Also see the Filebrowser project page.