Headline

CVE-2017-20091: Cross-Site Request Forgery in File Manager WordPress plugin

A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely.

2 years ago

CVE

Open in Source

#csrf #vulnerability #wordpress #php

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

Bugtraq mailing list archives

From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:03:30 +0100

------------------------------------------------------------------------ Cross-Site Request Forgery in File Manager WordPress plugin

David Vaartjes, July 2016

Abstract

A Cross-Site Request Forgery (CSRF) vulnerability was found in the File Manager WordPress Plugin. Among others, this issue can be used to upload arbitrary PHP files to the server.

OVE ID

OVE-20160712-0029

Tested versions

This issue was succesfully tested on the File Manager WordPress Plugin version 3.0.1.

Fix

There is currently no fix available.

Details

https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_file_manager_wordpress_plugin.html

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.

Current thread: