CVE-2023-38501 - CVE House

Back to Database

Status published Medium CVE-2023-38501

copyparty vulnerable to reflected cross-site scripting via k304 parameter

6.3 CVSS

Vulnerability Description

copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-38501

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from 9001

View All →

copyparty: Sharing a single file does not fully restrict access to other files in source folder

Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

copyparty Reflected XSS via Filter Parameter

copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata

copyparty renders unsanitized filenames as HTML when user uploads empty files

Affected Vendor

9001

View all reports →

Affected Software

copyparty

Vulnerable Versions:

< 1.8.7

Timeline

Official Publish: July 25th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement