{
"id": "GHSA-72wf-hwcq-65h9",
"aliases": [
"CVE-2021-46398"
],
"details": "A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.",
"summary": "Cross-Site Request Forgery in Filebrowser",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.18.0"
}
]
}
],
"package": {
"name": "github.com/filebrowser/filebrowser/v2",
"ecosystem": "Go"
}
}
],
"modified": "2024-05-20T21:22:49Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"published": "2022-02-05T00:00:31Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46398",
"type": "ADVISORY"
},
{
"url": "https://github.com/filebrowser/filebrowser/issues/1621",
"type": "WEB"
},
{
"url": "https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d",
"type": "WEB"
},
{
"url": "https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html",
"type": "WEB"
},
{
"url": "https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser",
"type": "WEB"
},
{
"url": "https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7",
"type": "WEB"
},
{
"url": "https://github.com/filebrowser/filebrowser",
"type": "WEB"
},
{
"url": "https://pkg.go.dev/vuln/GO-2022-0563",
"type": "WEB"
},
{
"url": "https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7",
"type": "WEB"
},
{
"url": "http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2022-02-04T16:15:00Z",
"github_reviewed_at": "2022-02-08T18:32:54Z"
}
}