CVE-2021-40965 - A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker

Back Back to CVE browser

HIGH

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker

Published Sep 15, 2021

8.8

HIGH

CVSS 3.1

EPSS 0.60%

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28119
Advisory
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528
x_refsource_MISCThird Party Advisory
https://github.com/prasathmani/tinyfilemanager
x_refsource_MISCProductThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28119		Advisory
https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528		x_refsource_MISCThird Party Advisory
https://github.com/prasathmani/tinyfilemanager		x_refsource_MISCProductThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 15, 2021

Updated Aug 4, 2024

Reserved Sep 13, 2021

Link CVE-2021-40965

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-40965

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Sep 15, 2021

Updated Aug 4, 2024

Link EUVD-2021-28119

GitHub

No data