Products
Dulldusk's PHP File Manager
- 1.7.8
Source
cve-coordination@incibe.es
Tags
CVE-2024-5673 details
Published : June 6, 2024, 11:15 a.m.
Last Modified : June 6, 2024, 2:17 p.m.
Last Modified : June 6, 2024, 2:17 p.m.
Description
Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.1 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Base Score
6.1
Exploitability Score
Impact Score
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
| URL | Source |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-php-file-manager-dulldusk | cve-coordination@incibe.es |
This website uses the NVD API, but is not approved or certified by it.