by Kastro
Paper/Archive/CVE-2024-11145

CVE-2024-11145

Valor Apps Easy Folder Listing Pro — Easy Folder Listing Pro deserialization vulnerability

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.0.630 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.

Affected

ProductAffectedFixed inSource
Easy Folder Listing Pro3.7 – < 3.83.8CNA
Easy Folder Listing Pro4.4 – < 4.54.5CNA
easy_folder_listing_pro3.7 – < 3.83.8CISA-ADP
easy_folder_listing_pro4.4 – < 4.54.5CISA-ADP

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa-cg (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refvalorapps.com/web-products/easy-folder-listing-pro.htmlrefgithub.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2024/va-24-331-01.json