GitHub Advisoryadvisory · Packagist

GHSA-3h9f-mm2x-4j58 Studio 42 elFinder vulnerable to Incorrect Access Control

HIGH Published 2024-07-30 Modified 2024-10-25 Official page ↗
Aliases
CVE-2024-38909
Ecosystem
Packagist
Packages
studio-42/elfinder
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2024-07-30

Affected packages

• Packagist studio-42/elfinder: <= 2.1.64 (no fix yet)

Description

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Related

Alias · CVE (1)

  • CVE-2024-38909 Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References