CVE-2019-16790CWE-78

Remote Code Execution in Tiny File Manager

Medium · published December 30, 2019

CVSS v3.1
6.5
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01243 · 69.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2019-12-30T19:15Z
EPSS history
Timeline
  • 30 DEC 19:15Z
    Remote Code Execution in Tiny File Manager
    cvelistv5