CVE-2022-0403
High
Description
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
SeverityHigh
CVSS8.1
Exploit probability—
ProductWpjos Library File Manager
PublishedApr 4, 2022
First seenApr 4, 2022
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- wpjos library_file_manager5.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpjos library_file_manager | v < 5.2.3 | 5.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.