PT-2023-25338 · Elfinder · Elfinder

Sectroyer · Publicado 2023-06-14 · Atualizado 2024-12-12 · CVE-2023-35840

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.62

Description The issue allows path traversal in the PHP LocalVolumeDriver connector due to incomplete validity checking of supplied request parameters. This can be exploited by allowing untrusted users to write to the local file system.

Recommendations For versions prior to 2.1.62, update to elFinder version 2.1.62 as soon as possible to fix the issue. If you cannot update for some reason, consider stopping the use of the vulnerable connector or prohibit writing to untrusted users.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-35840

GHSA-3P2Q-MH7Q-9PXJ

GHSA-WM5G-P99Q-66G4

Produtos afetados

Elfinder

Referências · 12

• 🔥 https://github.com/Studio-42/elFinder/security/advisories/GHSA-wm5g-p99q-66g4 · Exploit
• 🔥 https://github.com/afine-com/CVE-2023-35840 · Exploit
• 🔥 https://github.com/sectroyer/CVEs/tree/main/CVE-2023-35840 · Exploit
• https://github.com/Studio-42/elFinder · Nota
• https://github.com/Studio-42/elFinder/commit/bb9aaa7b096a1b83f2f85657c43f12131ece2891 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-35840 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3p2q-mh7q-9pxj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35840 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/8540 · Publicação no Telegram
• https://t.me/cvenotify/52596 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-wm5g-p99q-66g4 · Aviso do Fabricante
• https://t.me/cvenotify/103936 · Publicação no Telegram