CVE-2021-40965

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
VendorProductVersion
tinyfilemanager_projecttinyfilemanager
𝑥
≤ 2.4.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
https://github.com/prasathmani/tinyfilemanager
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
https://github.com/prasathmani/tinyfilemanager