High severity · published Apr 28, 2020
CVE-2020-12103
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak…
7.7
CVSS
1.5%
EPSS
No
On KEV
Description
In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tiny File Manager · Prasathmani
2.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12103
cyberaz0r.info
https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/
github.com
https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06
github.com
https://github.com/prasathmani/tinyfilemanager/issues/357
More from Tiny File Manager
9.8
CVE-2022-40916
Tiny File Manager v2.4.7 and below is vulnerable to session fixation
9.8
CVE-2022-45476
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download
9.8
CVE-2022-1000
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7
8.8
CVE-2022-23044
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application
8.8
CVE-2021-45010
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to…