Cells
Vendor:
First CVE: Jun 20, 2019 · Active for 7 years
16
Total CVEs
More Total CVEs than 92% of tracked products
4.0
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 33% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Cells over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 20, 2019
7 years ago
Most Recent CVE
Jun 8, 2023
1,143 days ago
CVE Severity & Scoring
Cells16 CVEs
69%
31%
All CVEs352,427 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (6.3%)
Network15 (93.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (93.8%)
High1 (6.3%)
Unknown0 (0.0%)
User Interaction
None11 (68.8%)
Unknown0 (0.0%)
Required5 (31.3%)
Privileges Required
Low12 (75.0%)
High2 (12.5%)
None2 (12.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-32749HIGH Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it | Jun 8, 2023 | 8.8 | 44 | NO | YES |
CVE-2023-32750MEDIUM Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be | Jun 8, 2023 | 6.5 | 31 | NO | YES |
CVE-2023-32751MEDIUM Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets | Jun 8, 2023 | 5.4 | 27 | NO | YES |
CVE-2019-12901HIGH Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged director | Jun 20, 2019 | 8.8 | 27 | NO | NO |
CVE-2020-12851HIGH Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a custom generated ZIP | Jun 4, 2020 | 8.1 | 25 | NO | NO |
CVE-2020-12847HIGH Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrat | Jun 4, 2020 | 7.2 | 24 | NO | NO |
CVE-2020-12850HIGH The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser pol | Jun 11, 2020 | 7.0 | 23 | NO | NO |
CVE-2020-12852MEDIUM The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update p | Jun 4, 2020 | 6.8 | 23 | NO | NO |
CVE-2021-41324MEDIUM Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) | Sep 30, 2021 | 6.5 | 22 | NO | NO |
CVE-2021-41325MEDIUM Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be grant | Sep 30, 2021 | 6.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
3 CVEs
18.8% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Cells
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.2.9 | 3 | 6.5 | 1.8% | 0 | 0 |
| 2.0.4 | 7 | 6.6 | 1.2% | 0 | 0 |