{"id":"CVE-2021-43421","published":"2022-04-07T16:18:14Z","modified":"2024-08-04T03:55:29Z","title":"A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a…","vendor":null,"product":null,"tier":"tail","description":{"text":"A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.42781,"percentile":0.98715,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/Studio-42/elFinder/issues/3429","tags":["x_refsource_MISC"]},{"url":"https://twitter.com/infosec_90/status/1455180286354919425","tags":["x_refsource_MISC"]}],"priority":{"score":24.7,"factors":[{"name":"EPSS percentile","points":19.74},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"nuclei":[{"id":"CVE-2021-43421","name":"Studio-42 elFinder <2.1.60 - Arbitrary File Upload","severity":"critical","path":"http/cves/2021/CVE-2021-43421.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43421.yaml"}],"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"studio-42/elfinder","vulnerableRanges":[">=2.0.4, <2.1.60"],"patched":["2.1.60"],"from":["GHSA-x4jx-hjwf-gc99"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1864","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-studio-42-elfinder-cve-2019-5884","parents":[{"from":"CVE-2021-32682","to":"CVE-2021-43421","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.59","toFixed":"2.1.60","daysApart":297},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17","https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb"],"basis":"shared function","functions":["__construct"]},{"kind":"similar","provenance":"machine","score":0.41,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2019-6257","published":"2019-01-14","fixed":"2.1.49","kev":false},{"cve":"CVE-2021-23394","published":"2021-06-13","fixed":"2.1.58","kev":false},{"cve":"CVE-2021-32682","published":"2021-06-14","fixed":"2.1.59","kev":false},{"cve":"CVE-2021-43421","published":"2022-04-07","fixed":"2.1.60","kev":false},{"cve":"CVE-2022-26960","published":"2022-03-21","fixed":"2.1.61","kev":false},{"cve":"CVE-2022-27115","published":"2022-04-11","fixed":"2.1.61","kev":false,"link":{"from":"CVE-2021-43421","to":"CVE-2022-27115","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:studio-42/elfinder","fromFixed":"2.1.60","toFixed":"2.1.61","daysApart":4},{"kind":"same-code","provenance":"machine","files":["php/elFinderVolumeLocalFileSystem.class.php"],"commits":["https://github.com/Studio-42/elFinder/commit/c08bcbfa722d758d01975799b7036951eb5d33cb","https://github.com/Studio-42/elFinder/commit/69be51eea5b484822a29ddd40f1b72845954ba60"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.35,"basis":"same package + description similarity"}]}},{"cve":"CVE-2023-35840","published":"2023-06-19","fixed":"2.1.62","kev":false}],"package":"Packagist:studio-42/elfinder"}}