PT-2025-2889 · Unknown · Trippo Responsivefilemanager

Published 2025-01-10 · Updated 2025-01-13 · CVE-2024-50807

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trippo Responsive Filemanager version 9.14.0

Description The issue is related to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. This occurs when files with these extensions are uploaded, potentially allowing malicious scripts to be executed.

Recommendations For Trippo Responsive Filemanager version 9.14.0, consider disabling file uploads with svg and pdf extensions until a patch is available. Restrict access to the file upload feature to minimize the risk of exploitation. Avoid using the file upload feature for svg and pdf files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50807

Affected Products

Trippo Responsivefilemanager

References · 7

• 🔥 https://github.com/SecShiv/CVE/blob/main/CVE-2024-50807.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50807 · Security Note
• https://twitter.com/CVEnew/status/1877751448731029947 · Twitter Post
• https://gist.github.com/HackShiv/4254db89214913867aa8dd5c1ec09b7e · Note
• https://t.me/cvedetector/14972 · Telegram Post
• https://gist.github.com/SecShiv/4254db89214913867aa8dd5c1ec09b7e · Note
• https://twitter.com/VulmonFeeds/status/1877791844043501574 · Twitter Post