CVE-2024-38909
published 2024-07-30CVE-2024-38909: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.4th percentile
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| std42 | elfinder | — | — |
| studio-42 | elfinder | 0 – 2.1.64 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Studio 42 elFinder vulnerable to Incorrect Access Control
ghsa·2024-07-30
CVE-2024-38909 [HIGH] CWE-284 Studio 42 elFinder vulnerable to Incorrect Access Control
Studio 42 elFinder vulnerable to Incorrect Access Control
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
OSV
Studio 42 elFinder vulnerable to Incorrect Access Control
osv·2024-07-30
CVE-2024-38909 [HIGH] Studio 42 elFinder vulnerable to Incorrect Access Control
Studio 42 elFinder vulnerable to Incorrect Access Control
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-30
Published