GitHub Advisoryadvisory · Packagist

GHSA-3qhm-qfj3-4rrx elFinder Server Side Request Forgery (SSRF)

HIGH Published 2022-05-13 Modified 2024-02-06 Official page ↗
Aliases
CVE-2019-6257
Ecosystem
Packagist
Packages
studio-42/elfinder
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2024-01-10

Affected packages

• Packagist studio-42/elfinder: < 2.1.49 → fixed in 2.1.49

Description

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.49 could allow a malicious user to access the content of internal network resources. This occurs in `get_remote_contents()` in `php/elFinder.class.php`.

Related

Alias · CVE (1)

  • CVE-2019-6257 A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References