Lucene search

[email protected]CVE-2022-23044

HistoryNov 25, 2022 - 5:15 p.m.

CVE-2022-23044

2022-11-2517:15:10

CWE-352

[email protected]

web.nvd.nist.gov

tiny file manager

v2.4.8

unauthenticated remote attack

csrf vulnerability

cve-2022-23044

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF.

Affected configurations

NVD

Node

tiny_file_manager_projecttiny_file_managerMatch2.4.8

CPENameOperatorVersion
tiny_file_manager_project:tiny_file_managertiny file manager project tiny file managereq2.4.8

CPE	Name	Operator	Version
tiny_file_manager_project:tiny_file_manager	tiny file manager project tiny file manager	eq	2.4.8

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Tiny File Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "2.4.8"
      }
    ]
  }
]

References

fluidattacks.com/advisories/mosey/

github.com/prasathmani/tinyfilemanager/

Social References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

Related for CVE-2022-23044

prion1 nvd1 cvelist1