by Kastro
Paper/Archive/CVE-2024-52306

CVE-2024-52306

Laravel-Backpack FileManager — FileManager Deserialization of Untrusted Data

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.0.500 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Affected

ProductAffectedFixed inSource
FileManager< 3.0.9–CNA
file_manager< 3.0.93.0.9CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2refgithub.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b