CVE-2019-5884: Sensitive Data Exposure in elFinder

Q: What is the severity of CVE-2019-5884?

CVE-2019-5884 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2019-5884?

To fix CVE-2019-5884, upgrade elFinder to version 2.1.45 or later.

Q: What information does CVE-2019-5884 leak?

CVE-2019-5884 can leak sensitive information when PHP's curl extension is enabled without safe_mode or open_basedir restrictions.

Q: Which versions of elFinder are affected by CVE-2019-5884?

elFinder versions earlier than 2.1.45 are affected by CVE-2019-5884.

Q: What conditions exacerbate CVE-2019-5884?

CVE-2019-5884 is exacerbated when PHP's curl extension is enabled and safe_mode or open_basedir is not configured.

Published Jan 10, 2019

Updated

php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set.

Affected Software

2 affected componentsFixes available

std42 elFinder<2.1.45

composer/studio-42/elfinder<2.1.45

2.1.45

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/studio-42/elfinder to a version that resolves this vulnerability.
Fixed in 2.1.45
Upgrade
Upgrade elFinder to a version that resolves this vulnerability.
Fixed in 2.1.45

Event History

Jan 10, 2019

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

May 13, 2022

Advisory Published

via Packagist·01:06 AM

Data Sourced

via Packagist·01:06 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-5884?

CVE-2019-5884 is classified as a medium severity vulnerability.

How do I fix CVE-2019-5884?