CVE-2024-7770: Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload
First published: Tue Sep 10 2024(Updated: )
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitapps File Manager | <6.5.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9cae7702-e531-45b9-9131-42edbc073a07?source=cve
- https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Http/Controllers/FileManagerController.php#L26
- https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinderConnector.class.php#L160
- https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L1210
- https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L3257
- https://plugins.trac.wordpress.org/changeset/3138710/
Frequently Asked Questions
What is the severity of CVE-2024-7770?
CVE-2024-7770 is rated as a high severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2024-7770?
To fix CVE-2024-7770, upgrade the Bit File Manager plugin to version 6.5.6 or later, which includes the necessary security improvements.
What is the impact of CVE-2024-7770?
The impact of CVE-2024-7770 allows attackers to upload malicious files to the server, potentially leading to remote code execution.
Which versions are affected by CVE-2024-7770?
CVE-2024-7770 affects all versions of the Bit File Manager plugin up to and including version 6.5.5.
Is the Bit File Manager plugin vulnerable due to file type validation?
Yes, CVE-2024-7770 exists because the Bit File Manager plugin lacks sufficient file type validation in its upload function.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/tags
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- vendor/bitapps
- canonical/bitapps file manager