PT-2013-3498 · Studio 42 · Elfinder

Published 2013-06-24 · Updated 2017-08-29 · CVE-2013-1972

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions elFinder file manager module versions 6.x-0.x before 6.x-0.8 elFinder file manager module versions 7.x-0.x before 7.x-0.8

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims and perform unauthorized file operations, such as creating, modifying, or deleting files.

Recommendations For elFinder file manager module versions 6.x-0.x before 6.x-0.8, update to version 6.x-0.8 or later. For elFinder file manager module versions 7.x-0.x before 7.x-0.8, update to version 7.x-0.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1972

Affected Products

Elfinder

References · 7

• https://drupal.org/node/1972082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1972 · Security Note
• https://drupal.org/node/1972084 · Note
• http://osvdb.org/92533 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0237.html · Note
• https://drupal.org/node/1972942 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83651 · Note