GHSA-3h9f-mm2x-4j58

Source

https://github.com/advisories/GHSA-3h9f-mm2x-4j58

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-3h9f-mm2x-4j58/GHSA-3h9f-mm2x-4j58.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3h9f-mm2x-4j58

Aliases

CVE-2024-38909

Published

2024-07-30T15:31:28Z

Modified

2024-10-25T22:10:55.531754Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Studio 42 elFinder vulnerable to Incorrect Access Control

Details

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Database specific

{
    "nvd_published_at": "2024-07-30T14:15:02Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-30T17:12:00Z"
}

References

Affected packages

Packagist / studio-42/elfinder

Package

Name: studio-42/elfinder
Purl: pkg:composer/studio-42/elfinder

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.1.64

Affected versions

2.*

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.1.19

2.1.20

2.1.21

2.1.22

2.1.23

2.1.24

2.1.25

2.1.26

2.1.27

2.1.28

2.1.29

2.1.30

2.1.31

2.1.32

2.1.33

2.1.34

2.1.35

2.1.36

2.1.37

2.1.38

2.1.39

2.1.40

2.1.41

2.1.42

2.1.43

2.1.44

2.1.45

2.1.46

2.1.47

2.1.48

2.1.49

2.1.50

2.1.51

2.1.52

2.1.53

2.1.54

2.1.55

2.1.56

2.1.57

2.1.58

2.1.59

2.1.60

2.1.61

2.1.62

2.1.63

2.1.64