CVE-2024-38909

CRITICAL

9.8

Description

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/30/2024

Last Modified4/28/2025

Sourcenvd

Honeypot Sightings0

Affected Products

std42:elfinder

Weaknesses (CWE)

CWE-284

References

http://elfinder.com(cve@mitre.org)

https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909(cve@mitre.org)

http://elfinder.com(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.