PT-2022-15804 · Unknown · Tiny File Manager

Carlos Bello · Published 2022-11-25 · Updated 2025-04-25 · CVE-2022-23044

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiny File Manager version 2.4.8

Description The issue allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application is vulnerable to CSRF, processes uploaded files server-side, and allows unauthenticated users to access uploaded files. The application can also persuade users to perform unintended actions within it due to the CSRF vulnerability.

Recommendations For Tiny File Manager version 2.4.8, as a temporary workaround, consider disabling the file upload feature until a patch is available. Restrict access to uploaded files to minimize the risk of exploitation. Avoid using the application for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-23044

Affected Products

Tiny File Manager

References · 7

• 🔥 https://github.com/prasathmani/tinyfilemanager · Exploit
• 🔥 https://fluidattacks.com/advisories/mosey · Exploit
• https://osv.dev/vulnerability/CVE-2022-23044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23044 · Security Note
• https://t.me/cibsecurity/53515 · Telegram Post
• https://t.me/cvenotify/38477 · Telegram Post
• https://t.me/cvenotify/119838 · Telegram Post