GO-2022-0563

vendorUSosv

Cross-site request forgery in github.com/filebrowser/filebrowser/v2

view advisory published 2022-02-05Licence: per source

A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-46398US	high8.8	6.72% (94th)	Exploit	2022-02-04
A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via…

references

External citations — patches, advisories, analysis.

https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8dFIX
https://github.com/filebrowser/filebrowser/issues/1621WEB
https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan