CVE-2024-38909: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows...
Description
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
Classification
CVE ID: CVE-2024-38909
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.2% (probability of being exploited)
EPSS Percentile: 39.01% (scored less or equal to compared to others)
EPSS Date: 2025-04-12 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: total
SSVC Automatable: true
References
https://nvd.nist.gov/vuln/detail/CVE-2024-38909http://elfinder.com
https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909