CVE-2021-32682
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
9.8
CVSS
69.9%
EPSS (exploit prob.)
99th
EPSS percentile
2021-06-14
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22CWE-78CWE-918
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| std42 | elfinder | < 2.1.59 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
- https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
- http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
- https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-32682