Patchfirst
Patchfirst
ChainStudio-42 · elFinderPackagist:studio-42/elfinder

Studio-42 elFinder: successive fixes (2019–2022)

6 CVEs over 4 generations, 10 Jan 2019 to 11 Apr 2022.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2019-588410 Jan 2019 First in the chain
  2. CVE-2019-919426 Feb 2019 next fix after CVE-2019-5884
  3. CVE-2021-2339413 Jun 2021 related to CVE-2019-9194
  4. CVE-2021-3268214 Jun 2021 related to CVE-2021-23394related to CVE-2019-5884and 1 more
  5. CVE-2021-434217 Apr 2022 related to CVE-2021-32682
  6. CVE-2022-2711511 Apr 2022 next fix after CVE-2021-43421related to CVE-2021-32682
Jan 2019AprApr 2020Apr 2021JulApr 2022 CVE-2021-23394 → CVE-2021-32682: related (high confidence)CVE-2021-32682 → CVE-2021-43421: related (high confidence)CVE-2021-43421 → CVE-2022-27115: Next fix in the same package (high confidence)CVE-2019-5884 → CVE-2021-32682: related (medium confidence)CVE-2019-9194 → CVE-2021-23394: related (medium confidence)CVE-2019-9194 → CVE-2021-32682: related (medium confidence)CVE-2021-32682 → CVE-2022-27115: related (medium confidence)CVE-2019-5884 → CVE-2019-9194: Next fix in the same package (low confidence) CVE-2019-5884 10 Jan 2019 CVE-2019-9194 26 Feb 2019 CVE-2021-23394 13 Jun 2021 CVE-2021-32682 14 Jun 2021 CVE-2021-43421 7 Apr 2022 CVE-2022-27115 11 Apr 2022 Jan 2019AprOctApr 2020OctApr 2021JulOctJan 2022Apr CVE-2021-23394 → CVE-2021-32682: related (high confidence)CVE-2021-32682 → CVE-2021-43421: related (high confidence)CVE-2021-43421 → CVE-2022-27115: Next fix in the same package (high confidence)CVE-2019-5884 → CVE-2021-32682: related (medium confidence)CVE-2019-9194 → CVE-2021-23394: related (medium confidence)CVE-2019-9194 → CVE-2021-32682: related (medium confidence)CVE-2021-32682 → CVE-2022-27115: related (medium confidence)CVE-2019-5884 → CVE-2019-9194: Next fix in the same package (low confidence) CVE-2019-5884 10 Jan 2019 CVE-2019-9194 26 Feb 2019 CVE-2021-23394 13 Jun 2021 CVE-2021-32682 14 Jun 2021 CVE-2021-43421 7 Apr 2022 CVE-2022-27115 11 Apr 2022
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2019-5884 10 Jan 2019 php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or… · fixed in 2.1.45 First in chain 14.0
CVE-2019-9194 26 Feb 2019 elFinder before 2.1.48 has a command injection vulnerability in the PHP connector · fixed in 2.1.48 CVE-2019-5884 · Next fix in the same package · Low 60.0
CVE-2021-23394 13 Jun 2021 Remote Code Execution (RCE) · fixed in 2.1.58 CVE-2019-9194 · related · Medium 65.1
CVE-2021-32682 14 Jun 2021 Multiple vulnerabilities leading to RCE · fixed in 2.1.59 CVE-2021-23394 · related · High 31.7
CVE-2021-43421 7 Apr 2022 A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a… · fixed in 2.1.60 CVE-2021-32682 · related · High 24.7
CVE-2022-27115 11 Apr 2022 In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for… · fixed in 2.1.61 CVE-2021-43421 · Next fix in the same package · High 19.6
↑ ↓ chooseEnter openEsc close