CVE-2022-0403

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04046.5The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic CVE-2022-04054.3Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04064.3Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04077.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04087.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04097.8Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.CVE-2022-04108.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a CVE-2022-04118.8The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a CVE-2022-04129.8The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and e CVE-2022-04137.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-04144.3Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.CVE-2022-04158.8Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.