CVE-2021-32682
Critical
Description
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
SeverityCritical
CVSS9.8
Exploit probability—
ProductStd42 Elfinder
PublishedJun 14, 2021
First seenJun 14, 2021
How to fix
Update
- std42 elfinder2.1.59 or later
- studio-42/elfinder2.1.59 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| std42 elfinder | v < 2.1.59 | 2.1.59 |
| studio-42/elfinderPackagist | v < 2.1.59 | 2.1.59 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.