High severity · published Nov 25, 2022
CVE-2022-23044
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tiny File Manager ·
2.4.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23044
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23044
Exploit
https://fluidattacks.com/advisories/mosey/
Exploit
https://github.com/prasathmani/tinyfilemanager/
More from Tiny File Manager
9.8
CVE-2022-45476
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download
6.5
CVE-2022-45475
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files