kkFileView 4.0.0 - Cross-Site Scripting

披露于 2022/05/25 · 更新于 2025/07/24

CVSS 评分6.1/ 10.0

EPSS 概率2.7%百分位 85.2%

漏洞描述

kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.

影响产品

kekingkkfileview查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

github.comhttps://github.com/kekingcn/kkFileView/issues/347↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-29349↗github.comhttps://github.com/ARPSyndicate/cvemon↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗

RELATED INTELLIGENCE

同产品关联漏洞

与 kkfileview 相关的其他公开漏洞。

查看全部 →

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2022-42149 kkFileView 4.0 - Server-Side Request Forgery kkfileview	严重	—	—	PoCEXP	2025/11/20
CVE-2022-46934 kkFileView 4.1.0 - Cross-Site Scripting kkfileview	中危	6.1	8.7%	PoCEXP	2023/02/02
CVE-2022-43140 kkFileView 4.1.0 - Server-Side Request Forgery kkfileview	高危	7.5	75.8%	PoCEXP	2022/11/21
CVE-2022-40879 kkFileView 4.1.0 - Cross-Site Scripting kkfileview	中危	6.1	26.3%	PoCEXP	2022/09/30
CVE-2022-35151 kkFileView 4.1.0 - Cross-Site Scripting kkfileview	中危	6.1	15.3%	PoCEXP	2022/08/18
CVE-2021-43734 kkFileview v4.0.0 - Local File Inclusion kkfileview	高危	7.5	49.2%	PoCEXP	2022/02/15