CVE-2024-7031 — Missing Authorization in Filester

CWE-862 — Missing Authorization4 documents4 sources
Severity
8.8HIGHNVD
CNA7.5
EPSS
0.7%
top 27.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ninjateam FilesterNinjateam File Manager PRO Filester
Timeline
PublishedAug 3
Latest updateSep 24

Description

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDninjateam/filester< 1.8.3

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

3
OSV
puma vulnerability↗2024-09-24
▶
CVEList
File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update↗2024-08-03
▶
GHSA
GHSA-fc63-998f-r568: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_↗2024-08-03
▶
CVE-2024-7031 — Missing Authorization in Filester | cvebase