x/vulndb: potential Go vuln in github.com/drakkan/sftpgo: CVE-2022-39220

[GoVulnBot]

CVE-2022-39220 references github.com/drakkan/sftpgo, which may be a Go module.

Description:
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-39220
• JSON: https://github.com/CVEProject/cvelist/tree/34ea0fabb2f66b9ad66a68228b3e2d1961fb8c5c/2022/39xxx/CVE-2022-39220.json
• web: GHSA-cf7g-cm7q-rq7f
• Imported by: https://pkg.go.dev/github.com/drakkan/sftpgo?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/drakkan/sftpgo
    packages:
      - package: sftpgo
description: |+
    SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.

cves:
  - CVE-2022-39220
references:
  - web: https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f

[gopherbot]

Change https://go.dev/cl/432174 mentions this issue: data/excluded: add GO-2022-1015.yaml for CVE-2022-39220

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607230 mentions this issue: data/reports: unexclude 20 reports (28)