Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated resource, the payload automatically executes in the admin’s browser context. Version 4.0.0-beta.420.7 contains a patch for the issue.
Weakness
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Coolify | Coollabs | * | 4.0.0 (excluding) |
| Coolify | Coollabs | 4.0.0-beta100 (including) | 4.0.0-beta100 (including) |
| Coolify | Coollabs | 4.0.0-beta101 (including) | 4.0.0-beta101 (including) |
| Coolify | Coollabs | 4.0.0-beta102 (including) | 4.0.0-beta102 (including) |
| Coolify | Coollabs | 4.0.0-beta103 (including) | 4.0.0-beta103 (including) |
| Coolify | Coollabs | 4.0.0-beta104 (including) | 4.0.0-beta104 (including) |
| Coolify | Coollabs | 4.0.0-beta105 (including) | 4.0.0-beta105 (including) |
| Coolify | Coollabs | 4.0.0-beta106 (including) | 4.0.0-beta106 (including) |
| Coolify | Coollabs | 4.0.0-beta107 (including) | 4.0.0-beta107 (including) |
| Coolify | Coollabs | 4.0.0-beta108 (including) | 4.0.0-beta108 (including) |
| Coolify | Coollabs | 4.0.0-beta109 (including) | 4.0.0-beta109 (including) |
| Coolify | Coollabs | 4.0.0-beta110 (including) | 4.0.0-beta110 (including) |
| Coolify | Coollabs | 4.0.0-beta111 (including) | 4.0.0-beta111 (including) |
| Coolify | Coollabs | 4.0.0-beta112 (including) | 4.0.0-beta112 (including) |
| Coolify | Coollabs | 4.0.0-beta113 (including) | 4.0.0-beta113 (including) |
| Coolify | Coollabs | 4.0.0-beta114 (including) | 4.0.0-beta114 (including) |
| Coolify | Coollabs | 4.0.0-beta115 (including) | 4.0.0-beta115 (including) |
| Coolify | Coollabs | 4.0.0-beta116 (including) | 4.0.0-beta116 (including) |
| Coolify | Coollabs | 4.0.0-beta117 (including) | 4.0.0-beta117 (including) |
| Coolify | Coollabs | 4.0.0-beta118 (including) | 4.0.0-beta118 (including) |
| Coolify | Coollabs | 4.0.0-beta119 (including) | 4.0.0-beta119 (including) |
| Coolify | Coollabs | 4.0.0-beta120 (including) | 4.0.0-beta120 (including) |
| Coolify | Coollabs | 4.0.0-beta121 (including) | 4.0.0-beta121 (including) |
| Coolify | Coollabs | 4.0.0-beta122 (including) | 4.0.0-beta122 (including) |
| Coolify | Coollabs | 4.0.0-beta123 (including) | 4.0.0-beta123 (including) |
| Coolify | Coollabs | 4.0.0-beta124 (including) | 4.0.0-beta124 (including) |
| Coolify | Coollabs | 4.0.0-beta125 (including) | 4.0.0-beta125 (including) |
| Coolify | Coollabs | 4.0.0-beta126 (including) | 4.0.0-beta126 (including) |
| Coolify | Coollabs | 4.0.0-beta127 (including) | 4.0.0-beta127 (including) |
| Coolify | Coollabs | 4.0.0-beta128 (including) | 4.0.0-beta128 (including) |
| Coolify | Coollabs | 4.0.0-beta129 (including) | 4.0.0-beta129 (including) |
| Coolify | Coollabs | 4.0.0-beta130 (including) | 4.0.0-beta130 (including) |
| Coolify | Coollabs | 4.0.0-beta131 (including) | 4.0.0-beta131 (including) |
| Coolify | Coollabs | 4.0.0-beta132 (including) | 4.0.0-beta132 (including) |
| Coolify | Coollabs | 4.0.0-beta133 (including) | 4.0.0-beta133 (including) |
| Coolify | Coollabs | 4.0.0-beta134 (including) | 4.0.0-beta134 (including) |
| Coolify | Coollabs | 4.0.0-beta135 (including) | 4.0.0-beta135 (including) |
| Coolify | Coollabs | 4.0.0-beta136 (including) | 4.0.0-beta136 (including) |
| Coolify | Coollabs | 4.0.0-beta137 (including) | 4.0.0-beta137 (including) |
| Coolify | Coollabs | 4.0.0-beta138 (including) | 4.0.0-beta138 (including) |
| Coolify | Coollabs | 4.0.0-beta139 (including) | 4.0.0-beta139 (including) |
| Coolify | Coollabs | 4.0.0-beta140 (including) | 4.0.0-beta140 (including) |
| Coolify | Coollabs | 4.0.0-beta141 (including) | 4.0.0-beta141 (including) |
| Coolify | Coollabs | 4.0.0-beta142 (including) | 4.0.0-beta142 (including) |
| Coolify | Coollabs | 4.0.0-beta143 (including) | 4.0.0-beta143 (including) |
| Coolify | Coollabs | 4.0.0-beta144 (including) | 4.0.0-beta144 (including) |
| Coolify | Coollabs | 4.0.0-beta145 (including) | 4.0.0-beta145 (including) |
| Coolify | Coollabs | 4.0.0-beta146 (including) | 4.0.0-beta146 (including) |
| Coolify | Coollabs | 4.0.0-beta147 (including) | 4.0.0-beta147 (including) |
| Coolify | Coollabs | 4.0.0-beta148 (including) | 4.0.0-beta148 (including) |
| Coolify | Coollabs | 4.0.0-beta149 (including) | 4.0.0-beta149 (including) |
| Coolify | Coollabs | 4.0.0-beta150 (including) | 4.0.0-beta150 (including) |
| Coolify | Coollabs | 4.0.0-beta151 (including) | 4.0.0-beta151 (including) |
| Coolify | Coollabs | 4.0.0-beta152 (including) | 4.0.0-beta152 (including) |
| Coolify | Coollabs | 4.0.0-beta153 (including) | 4.0.0-beta153 (including) |
| Coolify | Coollabs | 4.0.0-beta154 (including) | 4.0.0-beta154 (including) |
| Coolify | Coollabs | 4.0.0-beta155 (including) | 4.0.0-beta155 (including) |
| Coolify | Coollabs | 4.0.0-beta156 (including) | 4.0.0-beta156 (including) |
| Coolify | Coollabs | 4.0.0-beta157 (including) | 4.0.0-beta157 (including) |
| Coolify | Coollabs | 4.0.0-beta158 (including) | 4.0.0-beta158 (including) |
| Coolify | Coollabs | 4.0.0-beta159 (including) | 4.0.0-beta159 (including) |
| Coolify | Coollabs | 4.0.0-beta160 (including) | 4.0.0-beta160 (including) |
| Coolify | Coollabs | 4.0.0-beta161 (including) | 4.0.0-beta161 (including) |
| Coolify | Coollabs | 4.0.0-beta162 (including) | 4.0.0-beta162 (including) |
| Coolify | Coollabs | 4.0.0-beta163 (including) | 4.0.0-beta163 (including) |
| Coolify | Coollabs | 4.0.0-beta164 (including) | 4.0.0-beta164 (including) |
| Coolify | Coollabs | 4.0.0-beta165 (including) | 4.0.0-beta165 (including) |
| Coolify | Coollabs | 4.0.0-beta166 (including) | 4.0.0-beta166 (including) |
| Coolify | Coollabs | 4.0.0-beta167 (including) | 4.0.0-beta167 (including) |
| Coolify | Coollabs | 4.0.0-beta168 (including) | 4.0.0-beta168 (including) |
| Coolify | Coollabs | 4.0.0-beta169 (including) | 4.0.0-beta169 (including) |
| Coolify | Coollabs | 4.0.0-beta170 (including) | 4.0.0-beta170 (including) |
| Coolify | Coollabs | 4.0.0-beta171 (including) | 4.0.0-beta171 (including) |
| Coolify | Coollabs | 4.0.0-beta172 (including) | 4.0.0-beta172 (including) |
| Coolify | Coollabs | 4.0.0-beta173 (including) | 4.0.0-beta173 (including) |
| Coolify | Coollabs | 4.0.0-beta174 (including) | 4.0.0-beta174 (including) |
| Coolify | Coollabs | 4.0.0-beta175 (including) | 4.0.0-beta175 (including) |
| Coolify | Coollabs | 4.0.0-beta176 (including) | 4.0.0-beta176 (including) |
| Coolify | Coollabs | 4.0.0-beta177 (including) | 4.0.0-beta177 (including) |
| Coolify | Coollabs | 4.0.0-beta178 (including) | 4.0.0-beta178 (including) |
| Coolify | Coollabs | 4.0.0-beta179 (including) | 4.0.0-beta179 (including) |
| Coolify | Coollabs | 4.0.0-beta18 (including) | 4.0.0-beta18 (including) |
| Coolify | Coollabs | 4.0.0-beta180 (including) | 4.0.0-beta180 (including) |
| Coolify | Coollabs | 4.0.0-beta181 (including) | 4.0.0-beta181 (including) |
| Coolify | Coollabs | 4.0.0-beta182 (including) | 4.0.0-beta182 (including) |
| Coolify | Coollabs | 4.0.0-beta183 (including) | 4.0.0-beta183 (including) |
| Coolify | Coollabs | 4.0.0-beta184 (including) | 4.0.0-beta184 (including) |
| Coolify | Coollabs | 4.0.0-beta185 (including) | 4.0.0-beta185 (including) |
| Coolify | Coollabs | 4.0.0-beta186 (including) | 4.0.0-beta186 (including) |
| Coolify | Coollabs | 4.0.0-beta187 (including) | 4.0.0-beta187 (including) |
| Coolify | Coollabs | 4.0.0-beta188 (including) | 4.0.0-beta188 (including) |
| Coolify | Coollabs | 4.0.0-beta189 (including) | 4.0.0-beta189 (including) |
| Coolify | Coollabs | 4.0.0-beta19 (including) | 4.0.0-beta19 (including) |
| Coolify | Coollabs | 4.0.0-beta190 (including) | 4.0.0-beta190 (including) |
| Coolify | Coollabs | 4.0.0-beta191 (including) | 4.0.0-beta191 (including) |
| Coolify | Coollabs | 4.0.0-beta192 (including) | 4.0.0-beta192 (including) |
| Coolify | Coollabs | 4.0.0-beta193 (including) | 4.0.0-beta193 (including) |
| Coolify | Coollabs | 4.0.0-beta194 (including) | 4.0.0-beta194 (including) |
| Coolify | Coollabs | 4.0.0-beta195 (including) | 4.0.0-beta195 (including) |
| Coolify | Coollabs | 4.0.0-beta196 (including) | 4.0.0-beta196 (including) |
| Coolify | Coollabs | 4.0.0-beta197 (including) | 4.0.0-beta197 (including) |
| Coolify | Coollabs | 4.0.0-beta198 (including) | 4.0.0-beta198 (including) |
| Coolify | Coollabs | 4.0.0-beta199 (including) | 4.0.0-beta199 (including) |
| Coolify | Coollabs | 4.0.0-beta20 (including) | 4.0.0-beta20 (including) |
| Coolify | Coollabs | 4.0.0-beta200 (including) | 4.0.0-beta200 (including) |
| Coolify | Coollabs | 4.0.0-beta201 (including) | 4.0.0-beta201 (including) |
| Coolify | Coollabs | 4.0.0-beta202 (including) | 4.0.0-beta202 (including) |
| Coolify | Coollabs | 4.0.0-beta203 (including) | 4.0.0-beta203 (including) |
| Coolify | Coollabs | 4.0.0-beta204 (including) | 4.0.0-beta204 (including) |
| Coolify | Coollabs | 4.0.0-beta205 (including) | 4.0.0-beta205 (including) |
| Coolify | Coollabs | 4.0.0-beta206 (including) | 4.0.0-beta206 (including) |
| Coolify | Coollabs | 4.0.0-beta207 (including) | 4.0.0-beta207 (including) |
| Coolify | Coollabs | 4.0.0-beta208 (including) | 4.0.0-beta208 (including) |
| Coolify | Coollabs | 4.0.0-beta209 (including) | 4.0.0-beta209 (including) |
| Coolify | Coollabs | 4.0.0-beta21 (including) | 4.0.0-beta21 (including) |
| Coolify | Coollabs | 4.0.0-beta211 (including) | 4.0.0-beta211 (including) |
| Coolify | Coollabs | 4.0.0-beta212 (including) | 4.0.0-beta212 (including) |
| Coolify | Coollabs | 4.0.0-beta213 (including) | 4.0.0-beta213 (including) |
| Coolify | Coollabs | 4.0.0-beta214 (including) | 4.0.0-beta214 (including) |
| Coolify | Coollabs | 4.0.0-beta215 (including) | 4.0.0-beta215 (including) |
| Coolify | Coollabs | 4.0.0-beta216 (including) | 4.0.0-beta216 (including) |
| Coolify | Coollabs | 4.0.0-beta217 (including) | 4.0.0-beta217 (including) |
| Coolify | Coollabs | 4.0.0-beta218 (including) | 4.0.0-beta218 (including) |
| Coolify | Coollabs | 4.0.0-beta219 (including) | 4.0.0-beta219 (including) |
| Coolify | Coollabs | 4.0.0-beta22 (including) | 4.0.0-beta22 (including) |
| Coolify | Coollabs | 4.0.0-beta220 (including) | 4.0.0-beta220 (including) |
| Coolify | Coollabs | 4.0.0-beta221 (including) | 4.0.0-beta221 (including) |
| Coolify | Coollabs | 4.0.0-beta222 (including) | 4.0.0-beta222 (including) |
| Coolify | Coollabs | 4.0.0-beta223 (including) | 4.0.0-beta223 (including) |
| Coolify | Coollabs | 4.0.0-beta224 (including) | 4.0.0-beta224 (including) |
| Coolify | Coollabs | 4.0.0-beta225 (including) | 4.0.0-beta225 (including) |
| Coolify | Coollabs | 4.0.0-beta226 (including) | 4.0.0-beta226 (including) |
| Coolify | Coollabs | 4.0.0-beta227 (including) | 4.0.0-beta227 (including) |
| Coolify | Coollabs | 4.0.0-beta228 (including) | 4.0.0-beta228 (including) |
| Coolify | Coollabs | 4.0.0-beta229 (including) | 4.0.0-beta229 (including) |
| Coolify | Coollabs | 4.0.0-beta23 (including) | 4.0.0-beta23 (including) |
| Coolify | Coollabs | 4.0.0-beta230 (including) | 4.0.0-beta230 (including) |
| Coolify | Coollabs | 4.0.0-beta231 (including) | 4.0.0-beta231 (including) |
| Coolify | Coollabs | 4.0.0-beta232 (including) | 4.0.0-beta232 (including) |
| Coolify | Coollabs | 4.0.0-beta233 (including) | 4.0.0-beta233 (including) |
| Coolify | Coollabs | 4.0.0-beta234 (including) | 4.0.0-beta234 (including) |
| Coolify | Coollabs | 4.0.0-beta235 (including) | 4.0.0-beta235 (including) |
| Coolify | Coollabs | 4.0.0-beta236 (including) | 4.0.0-beta236 (including) |
| Coolify | Coollabs | 4.0.0-beta237 (including) | 4.0.0-beta237 (including) |
| Coolify | Coollabs | 4.0.0-beta238 (including) | 4.0.0-beta238 (including) |
| Coolify | Coollabs | 4.0.0-beta239 (including) | 4.0.0-beta239 (including) |
| Coolify | Coollabs | 4.0.0-beta24 (including) | 4.0.0-beta24 (including) |
| Coolify | Coollabs | 4.0.0-beta240 (including) | 4.0.0-beta240 (including) |
| Coolify | Coollabs | 4.0.0-beta241 (including) | 4.0.0-beta241 (including) |
| Coolify | Coollabs | 4.0.0-beta242 (including) | 4.0.0-beta242 (including) |
| Coolify | Coollabs | 4.0.0-beta243 (including) | 4.0.0-beta243 (including) |
| Coolify | Coollabs | 4.0.0-beta244 (including) | 4.0.0-beta244 (including) |
| Coolify | Coollabs | 4.0.0-beta245 (including) | 4.0.0-beta245 (including) |
| Coolify | Coollabs | 4.0.0-beta246 (including) | 4.0.0-beta246 (including) |
| Coolify | Coollabs | 4.0.0-beta247 (including) | 4.0.0-beta247 (including) |
| Coolify | Coollabs | 4.0.0-beta248 (including) | 4.0.0-beta248 (including) |
| Coolify | Coollabs | 4.0.0-beta249 (including) | 4.0.0-beta249 (including) |
| Coolify | Coollabs | 4.0.0-beta25 (including) | 4.0.0-beta25 (including) |
| Coolify | Coollabs | 4.0.0-beta250 (including) | 4.0.0-beta250 (including) |
| Coolify | Coollabs | 4.0.0-beta251 (including) | 4.0.0-beta251 (including) |
| Coolify | Coollabs | 4.0.0-beta252 (including) | 4.0.0-beta252 (including) |
| Coolify | Coollabs | 4.0.0-beta253 (including) | 4.0.0-beta253 (including) |
| Coolify | Coollabs | 4.0.0-beta254 (including) | 4.0.0-beta254 (including) |
| Coolify | Coollabs | 4.0.0-beta255 (including) | 4.0.0-beta255 (including) |
| Coolify | Coollabs | 4.0.0-beta256 (including) | 4.0.0-beta256 (including) |
| Coolify | Coollabs | 4.0.0-beta257 (including) | 4.0.0-beta257 (including) |
| Coolify | Coollabs | 4.0.0-beta258 (including) | 4.0.0-beta258 (including) |
| Coolify | Coollabs | 4.0.0-beta259 (including) | 4.0.0-beta259 (including) |
| Coolify | Coollabs | 4.0.0-beta26 (including) | 4.0.0-beta26 (including) |
| Coolify | Coollabs | 4.0.0-beta260 (including) | 4.0.0-beta260 (including) |
| Coolify | Coollabs | 4.0.0-beta261 (including) | 4.0.0-beta261 (including) |
| Coolify | Coollabs | 4.0.0-beta262 (including) | 4.0.0-beta262 (including) |
| Coolify | Coollabs | 4.0.0-beta263 (including) | 4.0.0-beta263 (including) |
| Coolify | Coollabs | 4.0.0-beta264 (including) | 4.0.0-beta264 (including) |
| Coolify | Coollabs | 4.0.0-beta265 (including) | 4.0.0-beta265 (including) |
| Coolify | Coollabs | 4.0.0-beta266 (including) | 4.0.0-beta266 (including) |
| Coolify | Coollabs | 4.0.0-beta267 (including) | 4.0.0-beta267 (including) |
| Coolify | Coollabs | 4.0.0-beta268 (including) | 4.0.0-beta268 (including) |
| Coolify | Coollabs | 4.0.0-beta269 (including) | 4.0.0-beta269 (including) |
| Coolify | Coollabs | 4.0.0-beta27 (including) | 4.0.0-beta27 (including) |
| Coolify | Coollabs | 4.0.0-beta270 (including) | 4.0.0-beta270 (including) |
| Coolify | Coollabs | 4.0.0-beta271 (including) | 4.0.0-beta271 (including) |
| Coolify | Coollabs | 4.0.0-beta272 (including) | 4.0.0-beta272 (including) |
| Coolify | Coollabs | 4.0.0-beta273 (including) | 4.0.0-beta273 (including) |
| Coolify | Coollabs | 4.0.0-beta274 (including) | 4.0.0-beta274 (including) |
| Coolify | Coollabs | 4.0.0-beta275 (including) | 4.0.0-beta275 (including) |
| Coolify | Coollabs | 4.0.0-beta276 (including) | 4.0.0-beta276 (including) |
| Coolify | Coollabs | 4.0.0-beta277 (including) | 4.0.0-beta277 (including) |
| Coolify | Coollabs | 4.0.0-beta278 (including) | 4.0.0-beta278 (including) |
| Coolify | Coollabs | 4.0.0-beta279 (including) | 4.0.0-beta279 (including) |
| Coolify | Coollabs | 4.0.0-beta28 (including) | 4.0.0-beta28 (including) |
| Coolify | Coollabs | 4.0.0-beta280 (including) | 4.0.0-beta280 (including) |
| Coolify | Coollabs | 4.0.0-beta281 (including) | 4.0.0-beta281 (including) |
| Coolify | Coollabs | 4.0.0-beta282 (including) | 4.0.0-beta282 (including) |
| Coolify | Coollabs | 4.0.0-beta283 (including) | 4.0.0-beta283 (including) |
| Coolify | Coollabs | 4.0.0-beta284 (including) | 4.0.0-beta284 (including) |
| Coolify | Coollabs | 4.0.0-beta285 (including) | 4.0.0-beta285 (including) |
| Coolify | Coollabs | 4.0.0-beta286 (including) | 4.0.0-beta286 (including) |
| Coolify | Coollabs | 4.0.0-beta287 (including) | 4.0.0-beta287 (including) |
| Coolify | Coollabs | 4.0.0-beta288 (including) | 4.0.0-beta288 (including) |
| Coolify | Coollabs | 4.0.0-beta289 (including) | 4.0.0-beta289 (including) |
| Coolify | Coollabs | 4.0.0-beta29 (including) | 4.0.0-beta29 (including) |
| Coolify | Coollabs | 4.0.0-beta290 (including) | 4.0.0-beta290 (including) |
| Coolify | Coollabs | 4.0.0-beta291 (including) | 4.0.0-beta291 (including) |
| Coolify | Coollabs | 4.0.0-beta292 (including) | 4.0.0-beta292 (including) |
| Coolify | Coollabs | 4.0.0-beta293 (including) | 4.0.0-beta293 (including) |
| Coolify | Coollabs | 4.0.0-beta294 (including) | 4.0.0-beta294 (including) |
| Coolify | Coollabs | 4.0.0-beta295 (including) | 4.0.0-beta295 (including) |
| Coolify | Coollabs | 4.0.0-beta296 (including) | 4.0.0-beta296 (including) |
| Coolify | Coollabs | 4.0.0-beta297 (including) | 4.0.0-beta297 (including) |
| Coolify | Coollabs | 4.0.0-beta298 (including) | 4.0.0-beta298 (including) |
| Coolify | Coollabs | 4.0.0-beta299 (including) | 4.0.0-beta299 (including) |
| Coolify | Coollabs | 4.0.0-beta30 (including) | 4.0.0-beta30 (including) |
| Coolify | Coollabs | 4.0.0-beta300 (including) | 4.0.0-beta300 (including) |
| Coolify | Coollabs | 4.0.0-beta301 (including) | 4.0.0-beta301 (including) |
| Coolify | Coollabs | 4.0.0-beta302 (including) | 4.0.0-beta302 (including) |
| Coolify | Coollabs | 4.0.0-beta303 (including) | 4.0.0-beta303 (including) |
| Coolify | Coollabs | 4.0.0-beta304 (including) | 4.0.0-beta304 (including) |
| Coolify | Coollabs | 4.0.0-beta305 (including) | 4.0.0-beta305 (including) |
| Coolify | Coollabs | 4.0.0-beta306 (including) | 4.0.0-beta306 (including) |
| Coolify | Coollabs | 4.0.0-beta307 (including) | 4.0.0-beta307 (including) |
| Coolify | Coollabs | 4.0.0-beta308 (including) | 4.0.0-beta308 (including) |
| Coolify | Coollabs | 4.0.0-beta309 (including) | 4.0.0-beta309 (including) |
| Coolify | Coollabs | 4.0.0-beta31 (including) | 4.0.0-beta31 (including) |
| Coolify | Coollabs | 4.0.0-beta310 (including) | 4.0.0-beta310 (including) |
| Coolify | Coollabs | 4.0.0-beta311 (including) | 4.0.0-beta311 (including) |
| Coolify | Coollabs | 4.0.0-beta312 (including) | 4.0.0-beta312 (including) |
| Coolify | Coollabs | 4.0.0-beta313 (including) | 4.0.0-beta313 (including) |
| Coolify | Coollabs | 4.0.0-beta314 (including) | 4.0.0-beta314 (including) |
| Coolify | Coollabs | 4.0.0-beta315 (including) | 4.0.0-beta315 (including) |
| Coolify | Coollabs | 4.0.0-beta316 (including) | 4.0.0-beta316 (including) |
| Coolify | Coollabs | 4.0.0-beta317 (including) | 4.0.0-beta317 (including) |
| Coolify | Coollabs | 4.0.0-beta318 (including) | 4.0.0-beta318 (including) |
| Coolify | Coollabs | 4.0.0-beta319 (including) | 4.0.0-beta319 (including) |
| Coolify | Coollabs | 4.0.0-beta32 (including) | 4.0.0-beta32 (including) |
| Coolify | Coollabs | 4.0.0-beta320 (including) | 4.0.0-beta320 (including) |
| Coolify | Coollabs | 4.0.0-beta321 (including) | 4.0.0-beta321 (including) |
| Coolify | Coollabs | 4.0.0-beta322 (including) | 4.0.0-beta322 (including) |
| Coolify | Coollabs | 4.0.0-beta323 (including) | 4.0.0-beta323 (including) |
| Coolify | Coollabs | 4.0.0-beta324 (including) | 4.0.0-beta324 (including) |
| Coolify | Coollabs | 4.0.0-beta325 (including) | 4.0.0-beta325 (including) |
| Coolify | Coollabs | 4.0.0-beta326 (including) | 4.0.0-beta326 (including) |
| Coolify | Coollabs | 4.0.0-beta327 (including) | 4.0.0-beta327 (including) |
| Coolify | Coollabs | 4.0.0-beta328 (including) | 4.0.0-beta328 (including) |
| Coolify | Coollabs | 4.0.0-beta329 (including) | 4.0.0-beta329 (including) |
| Coolify | Coollabs | 4.0.0-beta33 (including) | 4.0.0-beta33 (including) |
| Coolify | Coollabs | 4.0.0-beta330 (including) | 4.0.0-beta330 (including) |
| Coolify | Coollabs | 4.0.0-beta331 (including) | 4.0.0-beta331 (including) |
| Coolify | Coollabs | 4.0.0-beta332 (including) | 4.0.0-beta332 (including) |
| Coolify | Coollabs | 4.0.0-beta333 (including) | 4.0.0-beta333 (including) |
| Coolify | Coollabs | 4.0.0-beta334 (including) | 4.0.0-beta334 (including) |
| Coolify | Coollabs | 4.0.0-beta335 (including) | 4.0.0-beta335 (including) |
| Coolify | Coollabs | 4.0.0-beta336 (including) | 4.0.0-beta336 (including) |
| Coolify | Coollabs | 4.0.0-beta337 (including) | 4.0.0-beta337 (including) |
| Coolify | Coollabs | 4.0.0-beta338 (including) | 4.0.0-beta338 (including) |
| Coolify | Coollabs | 4.0.0-beta339 (including) | 4.0.0-beta339 (including) |
| Coolify | Coollabs | 4.0.0-beta34 (including) | 4.0.0-beta34 (including) |
| Coolify | Coollabs | 4.0.0-beta340 (including) | 4.0.0-beta340 (including) |
| Coolify | Coollabs | 4.0.0-beta341 (including) | 4.0.0-beta341 (including) |
| Coolify | Coollabs | 4.0.0-beta342 (including) | 4.0.0-beta342 (including) |
| Coolify | Coollabs | 4.0.0-beta343 (including) | 4.0.0-beta343 (including) |
| Coolify | Coollabs | 4.0.0-beta344 (including) | 4.0.0-beta344 (including) |
| Coolify | Coollabs | 4.0.0-beta345 (including) | 4.0.0-beta345 (including) |
| Coolify | Coollabs | 4.0.0-beta346 (including) | 4.0.0-beta346 (including) |
| Coolify | Coollabs | 4.0.0-beta347 (including) | 4.0.0-beta347 (including) |
| Coolify | Coollabs | 4.0.0-beta348 (including) | 4.0.0-beta348 (including) |
| Coolify | Coollabs | 4.0.0-beta349 (including) | 4.0.0-beta349 (including) |
| Coolify | Coollabs | 4.0.0-beta35 (including) | 4.0.0-beta35 (including) |
| Coolify | Coollabs | 4.0.0-beta350 (including) | 4.0.0-beta350 (including) |
| Coolify | Coollabs | 4.0.0-beta351 (including) | 4.0.0-beta351 (including) |
| Coolify | Coollabs | 4.0.0-beta352 (including) | 4.0.0-beta352 (including) |
| Coolify | Coollabs | 4.0.0-beta353 (including) | 4.0.0-beta353 (including) |
| Coolify | Coollabs | 4.0.0-beta354 (including) | 4.0.0-beta354 (including) |
| Coolify | Coollabs | 4.0.0-beta355 (including) | 4.0.0-beta355 (including) |
| Coolify | Coollabs | 4.0.0-beta356 (including) | 4.0.0-beta356 (including) |
| Coolify | Coollabs | 4.0.0-beta357 (including) | 4.0.0-beta357 (including) |
| Coolify | Coollabs | 4.0.0-beta358 (including) | 4.0.0-beta358 (including) |
| Coolify | Coollabs | 4.0.0-beta359 (including) | 4.0.0-beta359 (including) |
| Coolify | Coollabs | 4.0.0-beta36 (including) | 4.0.0-beta36 (including) |
| Coolify | Coollabs | 4.0.0-beta360 (including) | 4.0.0-beta360 (including) |
| Coolify | Coollabs | 4.0.0-beta361 (including) | 4.0.0-beta361 (including) |
| Coolify | Coollabs | 4.0.0-beta362 (including) | 4.0.0-beta362 (including) |
| Coolify | Coollabs | 4.0.0-beta363 (including) | 4.0.0-beta363 (including) |
| Coolify | Coollabs | 4.0.0-beta364 (including) | 4.0.0-beta364 (including) |
| Coolify | Coollabs | 4.0.0-beta365 (including) | 4.0.0-beta365 (including) |
| Coolify | Coollabs | 4.0.0-beta366 (including) | 4.0.0-beta366 (including) |
| Coolify | Coollabs | 4.0.0-beta367 (including) | 4.0.0-beta367 (including) |
| Coolify | Coollabs | 4.0.0-beta368 (including) | 4.0.0-beta368 (including) |
| Coolify | Coollabs | 4.0.0-beta369 (including) | 4.0.0-beta369 (including) |
| Coolify | Coollabs | 4.0.0-beta37 (including) | 4.0.0-beta37 (including) |
| Coolify | Coollabs | 4.0.0-beta370 (including) | 4.0.0-beta370 (including) |
| Coolify | Coollabs | 4.0.0-beta371 (including) | 4.0.0-beta371 (including) |
| Coolify | Coollabs | 4.0.0-beta372 (including) | 4.0.0-beta372 (including) |
| Coolify | Coollabs | 4.0.0-beta373 (including) | 4.0.0-beta373 (including) |
| Coolify | Coollabs | 4.0.0-beta374 (including) | 4.0.0-beta374 (including) |
| Coolify | Coollabs | 4.0.0-beta375 (including) | 4.0.0-beta375 (including) |
| Coolify | Coollabs | 4.0.0-beta376 (including) | 4.0.0-beta376 (including) |
| Coolify | Coollabs | 4.0.0-beta377 (including) | 4.0.0-beta377 (including) |
| Coolify | Coollabs | 4.0.0-beta378 (including) | 4.0.0-beta378 (including) |
| Coolify | Coollabs | 4.0.0-beta379 (including) | 4.0.0-beta379 (including) |
| Coolify | Coollabs | 4.0.0-beta38 (including) | 4.0.0-beta38 (including) |
| Coolify | Coollabs | 4.0.0-beta380 (including) | 4.0.0-beta380 (including) |
| Coolify | Coollabs | 4.0.0-beta381 (including) | 4.0.0-beta381 (including) |
| Coolify | Coollabs | 4.0.0-beta382 (including) | 4.0.0-beta382 (including) |
| Coolify | Coollabs | 4.0.0-beta383 (including) | 4.0.0-beta383 (including) |
| Coolify | Coollabs | 4.0.0-beta384 (including) | 4.0.0-beta384 (including) |
| Coolify | Coollabs | 4.0.0-beta385 (including) | 4.0.0-beta385 (including) |
| Coolify | Coollabs | 4.0.0-beta386 (including) | 4.0.0-beta386 (including) |
| Coolify | Coollabs | 4.0.0-beta387 (including) | 4.0.0-beta387 (including) |
| Coolify | Coollabs | 4.0.0-beta388 (including) | 4.0.0-beta388 (including) |
| Coolify | Coollabs | 4.0.0-beta389 (including) | 4.0.0-beta389 (including) |
| Coolify | Coollabs | 4.0.0-beta39 (including) | 4.0.0-beta39 (including) |
| Coolify | Coollabs | 4.0.0-beta390 (including) | 4.0.0-beta390 (including) |
| Coolify | Coollabs | 4.0.0-beta391 (including) | 4.0.0-beta391 (including) |
| Coolify | Coollabs | 4.0.0-beta392 (including) | 4.0.0-beta392 (including) |
| Coolify | Coollabs | 4.0.0-beta393 (including) | 4.0.0-beta393 (including) |
| Coolify | Coollabs | 4.0.0-beta394 (including) | 4.0.0-beta394 (including) |
| Coolify | Coollabs | 4.0.0-beta395 (including) | 4.0.0-beta395 (including) |
| Coolify | Coollabs | 4.0.0-beta396 (including) | 4.0.0-beta396 (including) |
| Coolify | Coollabs | 4.0.0-beta397 (including) | 4.0.0-beta397 (including) |
| Coolify | Coollabs | 4.0.0-beta398 (including) | 4.0.0-beta398 (including) |
| Coolify | Coollabs | 4.0.0-beta399 (including) | 4.0.0-beta399 (including) |
| Coolify | Coollabs | 4.0.0-beta40 (including) | 4.0.0-beta40 (including) |
| Coolify | Coollabs | 4.0.0-beta400 (including) | 4.0.0-beta400 (including) |
| Coolify | Coollabs | 4.0.0-beta401 (including) | 4.0.0-beta401 (including) |
| Coolify | Coollabs | 4.0.0-beta402 (including) | 4.0.0-beta402 (including) |
| Coolify | Coollabs | 4.0.0-beta404 (including) | 4.0.0-beta404 (including) |
| Coolify | Coollabs | 4.0.0-beta405 (including) | 4.0.0-beta405 (including) |
| Coolify | Coollabs | 4.0.0-beta406 (including) | 4.0.0-beta406 (including) |
| Coolify | Coollabs | 4.0.0-beta407 (including) | 4.0.0-beta407 (including) |
| Coolify | Coollabs | 4.0.0-beta408 (including) | 4.0.0-beta408 (including) |
| Coolify | Coollabs | 4.0.0-beta409 (including) | 4.0.0-beta409 (including) |
| Coolify | Coollabs | 4.0.0-beta41 (including) | 4.0.0-beta41 (including) |
| Coolify | Coollabs | 4.0.0-beta410 (including) | 4.0.0-beta410 (including) |
| Coolify | Coollabs | 4.0.0-beta411 (including) | 4.0.0-beta411 (including) |
| Coolify | Coollabs | 4.0.0-beta412 (including) | 4.0.0-beta412 (including) |
| Coolify | Coollabs | 4.0.0-beta413 (including) | 4.0.0-beta413 (including) |
| Coolify | Coollabs | 4.0.0-beta414 (including) | 4.0.0-beta414 (including) |
| Coolify | Coollabs | 4.0.0-beta415 (including) | 4.0.0-beta415 (including) |
| Coolify | Coollabs | 4.0.0-beta416 (including) | 4.0.0-beta416 (including) |
| Coolify | Coollabs | 4.0.0-beta417 (including) | 4.0.0-beta417 (including) |
| Coolify | Coollabs | 4.0.0-beta418 (including) | 4.0.0-beta418 (including) |
| Coolify | Coollabs | 4.0.0-beta419 (including) | 4.0.0-beta419 (including) |
| Coolify | Coollabs | 4.0.0-beta42 (including) | 4.0.0-beta42 (including) |
| Coolify | Coollabs | 4.0.0-beta420 (including) | 4.0.0-beta420 (including) |
| Coolify | Coollabs | 4.0.0-beta420.1 (including) | 4.0.0-beta420.1 (including) |
| Coolify | Coollabs | 4.0.0-beta420.2 (including) | 4.0.0-beta420.2 (including) |
| Coolify | Coollabs | 4.0.0-beta420.3 (including) | 4.0.0-beta420.3 (including) |
| Coolify | Coollabs | 4.0.0-beta420.4 (including) | 4.0.0-beta420.4 (including) |
| Coolify | Coollabs | 4.0.0-beta420.5 (including) | 4.0.0-beta420.5 (including) |
| Coolify | Coollabs | 4.0.0-beta420.6 (including) | 4.0.0-beta420.6 (including) |
| Coolify | Coollabs | 4.0.0-beta43 (including) | 4.0.0-beta43 (including) |
| Coolify | Coollabs | 4.0.0-beta44 (including) | 4.0.0-beta44 (including) |
| Coolify | Coollabs | 4.0.0-beta45 (including) | 4.0.0-beta45 (including) |
| Coolify | Coollabs | 4.0.0-beta46 (including) | 4.0.0-beta46 (including) |
| Coolify | Coollabs | 4.0.0-beta47 (including) | 4.0.0-beta47 (including) |
| Coolify | Coollabs | 4.0.0-beta48 (including) | 4.0.0-beta48 (including) |
| Coolify | Coollabs | 4.0.0-beta49 (including) | 4.0.0-beta49 (including) |
| Coolify | Coollabs | 4.0.0-beta50 (including) | 4.0.0-beta50 (including) |
| Coolify | Coollabs | 4.0.0-beta51 (including) | 4.0.0-beta51 (including) |
| Coolify | Coollabs | 4.0.0-beta52 (including) | 4.0.0-beta52 (including) |
| Coolify | Coollabs | 4.0.0-beta53 (including) | 4.0.0-beta53 (including) |
| Coolify | Coollabs | 4.0.0-beta54 (including) | 4.0.0-beta54 (including) |
| Coolify | Coollabs | 4.0.0-beta55 (including) | 4.0.0-beta55 (including) |
| Coolify | Coollabs | 4.0.0-beta56 (including) | 4.0.0-beta56 (including) |
| Coolify | Coollabs | 4.0.0-beta57 (including) | 4.0.0-beta57 (including) |
| Coolify | Coollabs | 4.0.0-beta58 (including) | 4.0.0-beta58 (including) |
| Coolify | Coollabs | 4.0.0-beta59 (including) | 4.0.0-beta59 (including) |
| Coolify | Coollabs | 4.0.0-beta60 (including) | 4.0.0-beta60 (including) |
| Coolify | Coollabs | 4.0.0-beta61 (including) | 4.0.0-beta61 (including) |
| Coolify | Coollabs | 4.0.0-beta62 (including) | 4.0.0-beta62 (including) |
| Coolify | Coollabs | 4.0.0-beta63 (including) | 4.0.0-beta63 (including) |
| Coolify | Coollabs | 4.0.0-beta64 (including) | 4.0.0-beta64 (including) |
| Coolify | Coollabs | 4.0.0-beta65 (including) | 4.0.0-beta65 (including) |
| Coolify | Coollabs | 4.0.0-beta66 (including) | 4.0.0-beta66 (including) |
| Coolify | Coollabs | 4.0.0-beta67 (including) | 4.0.0-beta67 (including) |
| Coolify | Coollabs | 4.0.0-beta68 (including) | 4.0.0-beta68 (including) |
| Coolify | Coollabs | 4.0.0-beta69 (including) | 4.0.0-beta69 (including) |
| Coolify | Coollabs | 4.0.0-beta70 (including) | 4.0.0-beta70 (including) |
| Coolify | Coollabs | 4.0.0-beta71 (including) | 4.0.0-beta71 (including) |
| Coolify | Coollabs | 4.0.0-beta72 (including) | 4.0.0-beta72 (including) |
| Coolify | Coollabs | 4.0.0-beta73 (including) | 4.0.0-beta73 (including) |
| Coolify | Coollabs | 4.0.0-beta74 (including) | 4.0.0-beta74 (including) |
| Coolify | Coollabs | 4.0.0-beta75 (including) | 4.0.0-beta75 (including) |
| Coolify | Coollabs | 4.0.0-beta76 (including) | 4.0.0-beta76 (including) |
| Coolify | Coollabs | 4.0.0-beta77 (including) | 4.0.0-beta77 (including) |
| Coolify | Coollabs | 4.0.0-beta78 (including) | 4.0.0-beta78 (including) |
| Coolify | Coollabs | 4.0.0-beta79 (including) | 4.0.0-beta79 (including) |
| Coolify | Coollabs | 4.0.0-beta80 (including) | 4.0.0-beta80 (including) |
| Coolify | Coollabs | 4.0.0-beta81 (including) | 4.0.0-beta81 (including) |
| Coolify | Coollabs | 4.0.0-beta82 (including) | 4.0.0-beta82 (including) |
| Coolify | Coollabs | 4.0.0-beta83 (including) | 4.0.0-beta83 (including) |
| Coolify | Coollabs | 4.0.0-beta84 (including) | 4.0.0-beta84 (including) |
| Coolify | Coollabs | 4.0.0-beta85 (including) | 4.0.0-beta85 (including) |
| Coolify | Coollabs | 4.0.0-beta86 (including) | 4.0.0-beta86 (including) |
| Coolify | Coollabs | 4.0.0-beta87 (including) | 4.0.0-beta87 (including) |
| Coolify | Coollabs | 4.0.0-beta88 (including) | 4.0.0-beta88 (including) |
| Coolify | Coollabs | 4.0.0-beta89 (including) | 4.0.0-beta89 (including) |
| Coolify | Coollabs | 4.0.0-beta90 (including) | 4.0.0-beta90 (including) |
| Coolify | Coollabs | 4.0.0-beta91 (including) | 4.0.0-beta91 (including) |
| Coolify | Coollabs | 4.0.0-beta92 (including) | 4.0.0-beta92 (including) |
| Coolify | Coollabs | 4.0.0-beta93 (including) | 4.0.0-beta93 (including) |
| Coolify | Coollabs | 4.0.0-beta94 (including) | 4.0.0-beta94 (including) |
| Coolify | Coollabs | 4.0.0-beta95 (including) | 4.0.0-beta95 (including) |
| Coolify | Coollabs | 4.0.0-beta96 (including) | 4.0.0-beta96 (including) |
| Coolify | Coollabs | 4.0.0-beta97 (including) | 4.0.0-beta97 (including) |
| Coolify | Coollabs | 4.0.0-beta98 (including) | 4.0.0-beta98 (including) |
| Coolify | Coollabs | 4.0.0-beta99 (including) | 4.0.0-beta99 (including) |
Extended Description
Improper encoding or escaping can allow attackers to change the commands that are sent to another component, inserting malicious commands instead. Most products follow a certain protocol that uses structured messages for communication between components, such as queries or commands. These structured messages can contain raw data interspersed with metadata or control information. For example, “GET /index.html HTTP/1.1” is a structured message containing a command (“GET”) with a single argument ("/index.html") and metadata about which protocol version is being used (“HTTP/1.1”). If an application uses attacker-supplied inputs to construct a structured message without properly encoding or escaping, then the attacker could insert special characters that will cause the data to be interpreted as control information or metadata. Consequently, the component that receives the output will perform the wrong operations, or otherwise interpret the data incorrectly.
Potential Mitigations
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
- Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
- If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
- For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/104.html
- https://cwe.mitre.org/data/definitions/73.html
- https://cwe.mitre.org/data/definitions/81.html
- https://cwe.mitre.org/data/definitions/85.html