CVE-2021-23428: Directory Traversal
Published Sep 1, 2021
·Updated
This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
Affected Software
1 affected component
Elfinder.netcore Project Elfinder.netcore
Event History
Sep 1, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-23428?
CVE-2021-23428 has a medium severity due to its potential for path traversal vulnerabilities.
2
How do I fix CVE-2021-23428?
To fix CVE-2021-23428, ensure that user input is properly sanitized and validate file paths before usage.
3
What software is affected by CVE-2021-23428?
CVE-2021-23428 affects all versions of the elFinder.NetCore package.
4
What type of vulnerability is CVE-2021-23428?
CVE-2021-23428 is a path traversal vulnerability that allows escaping of the Files directory.
5
Can CVE-2021-23428 lead to sensitive information exposure?
Yes, CVE-2021-23428 can potentially lead to exposure of sensitive files if exploited.