CVE-2023-26961

MEDIUM EPSS 34.9%

Published Aug 8, 20232y ago · Modified Jun 17, 20262w ago

4.8 CVSS 3.1

Medium

Published Aug 8, 2023 2y ago

Last Modified Jun 17, 2026 2w ago

Description

Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.

CVSS Details

Base Score

4.8

Exploitability

1.7

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

34.9% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
alteryx	alteryx_server	2022.1.1.42590	any

References 2

alteryx.com http://alteryx.com

Vendor Advisory
gist.github.com https://gist.github.com/DylanGrl/4269ae834c5d0ec77c9b928ad35d3be3

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.