CVE-2021-40965

EUVD-2021-28119
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
Affected Products (NVD)
VendorProductVersion
prasathmanitiny_file_manager
𝑥
≤ 2.4.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
https://github.com/prasathmani/tinyfilemanager
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
https://github.com/prasathmani/tinyfilemanager