CVE-2024-5673

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-5673

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5673.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-5673

Published

2024-06-06T10:19:34.669Z

Modified

2026-07-15T01:48:49.608674108Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-Site Scripting in PHP File Manager by Dulldusk

Details

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fmcurrentdir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5673.json",
    "cna_assigner": "INCIBE",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.7.8"
                },
                {
                    "last_affected": "1.7.8"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/dulldusk/phpfm

Affected ranges

Type

GIT

Repo

https://github.com/dulldusk/phpfm

Events

Introduced

cfa0ebd05a5c818cb035d576d41a3eb3d2489af9

Last affected

cfa0ebd05a5c818cb035d576d41a3eb3d2489af9

Database specific

{
    "cpe": "cpe:2.3:a:dulldusk:phpfilemanager:1.7.8:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "1.7.8"
        },
        {
            "last_affected": "1.7.8"
        }
    ]
}

Affected versions

1.*

1.7.8

v1.*

v1.7.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5673.json"