Описание
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
Ссылки
- Third Party Advisory
- ProductThird Party Advisory
- Third Party Advisory
- ProductThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.4.6 (включая)
cpe:2.3:a:prasathmani:tiny_file_manager:*:*:*:*:*:*:*:*
EPSS
Процентиль: 33%
0.00134
Низкий
8.8 High
CVSS3
9.3 Critical
CVSS2
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 8.8
github
больше 3 лет назад
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
EPSS
Процентиль: 33%
0.00134
Низкий
8.8 High
CVSS3
9.3 Critical
CVSS2
Дефекты
CWE-352