CVE-2024-9669 — Path Traversal in Filester

CWE-22 — Path Traversal3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 67.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ninjateam FilesterNinjateam File Manager PRO Filester
Timeline
PublishedNov 28

Description

The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and othe…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDninjateam/filester< 1.8.6

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion↗2024-11-28
▶
GHSA
GHSA-2vcg-x9q7-3f22: The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1↗2024-11-28
▶
CVE-2024-9669 — Path Traversal in Ninjateam Filester | cvebase