9.3
CVE-2021-40965
- EPSS 0.58%
- Veröffentlicht 15.09.2021 18:15:09
- Zuletzt bearbeitet 31.12.2025 19:40:50
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Prasathmani ≫ Tiny File Manager Version <= 2.4.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.58% | 0.429 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
https://github.com/prasathmani/tinyfilemanager