CVE-2024-5673 MEDIUM

CVE-2024-5673: Cross-Site Scripting in PHP File Manager by Dulldusk

Vendor Dulldusk

Product PHP File Manager

Weakness CWE-79 · XSS

Published June 6, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.

Key dates

02Disclosure timeline

June 6, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-5673 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-39647 WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-2030 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVE-2024-49702 WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability CVE-2019-12631 Cisco Identity Services Engine Cross-Site Scripting Vulnerability CVE-2023-1771 SourceCodester Grade Point Average GPA Calculator Master.php get_scale cross site scripting