logo

Database

Server-side request forgery (SSRF) In studio-42/elfinder

Description

elFinder Server Side Request Forgery (SSRF) A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.49 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2019-62572. NVD-2019-62573. OSV-2019-62574. GCVE-2019-6257

References

1. https://github.com/Studio-42/elFinder/commit/2f522db8f037a66ce9040ee0b216aa4a0359286c2. https://github.com/FriendsOfPHP/security-advisories/blob/master/studio-42/elfinder/CVE-2019-6257.yaml3. https://github.com/Studio-42/elFinder/blob/2.1.49/Changelog4. https://github.com/Studio-42/elFinder/releases/tag/2.1.49

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.