Frontend File Manager Plugin, da8fe4b1-1505-40d2-b16c-1533a2a6051a
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- Frontend File Manager Plugin [nmedia-user-file-uploader] < 21.4 Frontend File Manager < 21.4 - Arbitrary Settings Update via CSRF The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. As the plugin does not validate the allowed file type, this could lead to attackers making admins allowing PHP file to be uploaded by any authenticated users
- Affected versions
-
max 21.4.
- Status
-
vulnerable