Vulnerability Description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Std42 | Elfinder | < 2.1.59 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.hExploitThird Party AdvisoryVDB Entry
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabiliExploitThird Party Advisory
- https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe08PatchThird Party Advisory
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92prThird Party Advisory
- http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.hExploitThird Party AdvisoryVDB Entry
- https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabiliExploitThird Party Advisory
- https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe08PatchThird Party Advisory
- https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92prThird Party Advisory
FAQ
What is CVE-2021-32682?
CVE-2021-32682 is a vulnerability with a CVSS score of 9.8 (CRITICAL). elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary...
How severe is CVE-2021-32682?
CVE-2021-32682 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-32682?
Check the references section above for vendor advisories and patch information. Affected products include: Std42 Elfinder.