CVE-2022-0403: unknown library file manager
Vulnerability summary
CVE-2022-0403 is a high (CVSS 8.8) vulnerability in unknown library file manager. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 69% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
EPSS trend
Probability
1.25%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- library file manager≥ 5.2.3, < 5.2.3
Wordpress1 product
- file-manager≤ 5.2.2 (fixed in 5.2.3)
Wpjos1 product
- library_file_manager< 5.2.3
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/997a7fbf-98c6-453e-ad84-75c1e91d5a1eX Refsource MISCExploitThird Party Advisory