Medium severity · published Nov 25, 2022
CVE-2022-45475
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tiny File Manager · Prasathmani
2.4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45475
Exploit
https://fluidattacks.com/advisories/mosey/
Product
https://github.com/prasathmani/tinyfilemanager/
More from Tiny File Manager
9.8
CVE-2022-40916
Tiny File Manager v2.4.7 and below is vulnerable to session fixation
9.8
CVE-2022-45476
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download
9.8
CVE-2022-1000
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7
8.8
CVE-2022-23044
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application
8.8
CVE-2021-45010
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to…