CVE-2021-46398: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
Other sources
A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-46398?
CVE-2021-46398 is a Cross-Site Request Forgery vulnerability in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and gain access to the filesystem.
How severe is CVE-2021-46398?
CVE-2021-46398 has a severity rating of high with a score of 8.8.
How does CVE-2021-46398 work?
CVE-2021-46398 allows attackers to exploit a Cross-Site Request Forgery vulnerability in Filebrowser < 2.18.0 to create a malicious HTML webpage that can be used to create a backdoor user with admin privilege and access the filesystem.
Which software versions are affected by CVE-2021-46398?
Filebrowser versions prior to 2.18.0 are affected by CVE-2021-46398.
Are there any references for CVE-2021-46398?
Yes, you can find references for CVE-2021-46398 at the following URLs: [1] http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html [2] https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html [3] https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/