GitHub Advisoryadvisory · Packagist

GHSA-jcgc-vxqg-85xx Sensitive Data Exposure in elFinder

MEDIUM Published 2022-05-13 Modified 2023-07-07 Official page ↗

Aliases: CVE-2019-5884
Ecosystem: Packagist
Packages: studio-42/elfinder
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-200
Reviewed: 2023-07-07

Affected packages

• Packagist studio-42/elfinder: < 2.1.45 → fixed in 2.1.45

Description

`php/elFinder.class.php` in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and `safe_mode` or `open_basedir` is not set.

Related

Alias · CVE (1)

CVE-2019-5884 php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not… vulnerability

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References