Multiple vulnerabilities leading to RCE
75Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.8epss 70%
de la publicación al arma0 días
Publicada en NVD14 jun
metasploit13 jun
probabilidad de explotación
70%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Studio-42 · elFinderPoCs públicas encontradas — 1
cve_referencepacketstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.htmlhttps://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr