What is CVE-2024-38909?

CVE-2024-38909 is a critical-severity vulnerability in Std42 Elfinder, classified under Improper Access Control. CVSS score: 9.8/10. Published 2024-07-30.

How severe is CVE-2024-38909?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Std42 Elfinder

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

EPSS: 0.005 (38.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Std42 Elfinder — versions 2.1.64
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

af854a3a-2127-422b-91ae-364da2661108 (Permissions Required)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2024-38909?: CVE-2024-38909 is a critical-severity vulnerability in Std42 Elfinder, classified under Improper Access Control. CVSS score: 9.8/10. Published 2024-07-30.
How severe is CVE-2024-38909?: Critical severity. CVSS v3 base score is 9.8 out of 10.