CVE-2024-1538highCWE-352

CVE-2024-1538: high-severity vulnerability in mndpsingh287 File Manager

File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion

Published · Updated

Follow this CVE+ Monitor File Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 11%
In short

The File Manager plugin for WordPress can be tricked into loading malicious local JavaScript files through a forged request. An attacker can craft a link that, when clicked by a site admin, executes code on the server.

Technical detail

Cross-Site Request Forgery vulnerability due to missing nonce validation on the wp_file_manager page's 'lang' parameter allows unauthenticated attackers to inject local JavaScript files. Exploitation requires social engineering (admin clicking a malicious link) but can result in Remote Code Execution once the file is included.

Summary generated and translated by AI from the official description.
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
mndpsingh287 · File Manager
Related CVEs — mndpsingh287 File Manager

In the same product, most dangerous first.

CVE-2023-6825CRITICALFile Manager And File Manager Pro (Multiple Versions) - Directory TraversalEPSS 6.0%CVE-2024-0761HIGHFile Manager <= 7.2.1 - Sensitive Information Exposure via Backup FilenamesEPSS 1.0%CVE-2024-2654MEDIUMFile Manager <= 7.2.5 - Authenticated (Administrator+) Directory TraversalEPSS 0.9%CVE-2018-25105CRITICALFile Manager <= 3.0 - Unauthenticated Arbitrary File Upload/DownloadEPSS 0.8%CVE-2024-37254MEDIUMWordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerabilityEPSS 0.3%