CVE-2019-7174

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and…

published April 9, 2019

CVSS
—
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

⚠️ An unsuspecting file manager is the perfect playground for attackers! With Roxy Fileman 1.4.5, they can execute critical operations like renaming or moving files without breaking a sweat. 😱 Think of Roxy Fileman as a busy restaurant kitchen where the chef can whip up any dish just by asking. If the waiter (an attacker) can place orders without checking in with the chef (the system), they could serve anything they want, including unwanted surprises! If exploited, an attacker could rename, create, or move files at will, potentially leading to unauthorized access or data loss. This could disrupt business operations or expose sensitive information, making the situation absolutely devastating!

Put simply

Think of Roxy Fileman as a busy restaurant kitchen where the chef can whip up any dish just by asking. If the waiter (an attacker) can place orders without checking in with the chef (the system), they could serve anything they want, including unwanted surprises! The vulnerability allows attackers to execute file manipulation operations like rename, create directory, and move files through Roxy Fileman's interface, even without proper authorization checks. This means they can play around with file structures as they please.

What to do

If exploited, an attacker could rename, create, or move files at will, potentially leading to unauthorized access or data loss. This could disrupt business operations or expose sensitive information, making the situation absolutely devastating! To protect your system, ensure Roxy Fileman is updated to a patched version. Review user permissions carefully and limit access to trusted personnel only. Regularly monitor file activities for any unauthorized changes. You've got this! Secure your file manager and keep your digital kitchen safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01656 · 76.4th percentile
Published
2019-04-09T17:58Z
EPSS history
Timeline
  • 09 APR 17:58Z
    Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and…
    cvelistv5