extplorer - Cross-Site Request Forgery (CSRF) Vulnerability
Summary
DLA-485-1: extplorer - security update. Affects extplorer versions < 2.1.0b6+dfsg.3-4+deb7u3. Fixed in 2.1.0b6+dfsg.3-4+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
extplorer is a package available for Debian 7 Wheezy. It is a web-based file manager that allows users to manage files and directories on a web server. The extplorer package is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to unauthorized execution of PHP code.
Vulnerability Detail
The Cross-Site Request Forgery (CSRF) vulnerability in extplorer allows remote attackers to hijack the authentication of arbitrary users. By tricking a user into visiting a malicious website or clicking on a specially crafted link, an attacker can perform actions on behalf of the user without their consent. This can lead to the execution of arbitrary PHP code, potentially compromising the server and the data stored on it.
How To Fix
Minimum fixed version
2.1.0b6+dfsg.3-4+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade extplorerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
extplorer is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to unauthorized execution of PHP code. To mitigate this vulnerability, it is crucial to upgrade the extplorer package to version 2.1.0b6+dfsg.3-4+deb7u3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for extplorer →
FAQ
extplorer is a web-based file manager for managing files and directories on a web server.
A Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to perform actions on behalf of a user without their consent by tricking them into visiting a malicious website or clicking on a specially crafted link.
The CSRF vulnerability in extplorer can lead to the execution of arbitrary PHP code, potentially compromising the server and the data stored on it.
To fix this vulnerability, you should upgrade the extplorer package to version 2.1.0b6+dfsg.3-4+deb7u3 or later by using the package manager of the Debian 7 Wheezy system.
No specific workarounds have been mentioned for this vulnerability. It is recommended to upgrade the extplorer package to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for extplorer.
