« Volver al listado

CVE-2008-4319

Estado: ModificadaMedia (6.4)—

fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Libra File Manager — PHP Filemanager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4319",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-29T19:25:35.760",
  "references": [
    {
      "url": "http://www.securityfocus.com/archive/1/496742",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31415",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45423",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6567",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/496742",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31415",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45423",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6567",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string."
    },
    {
      "lang": "es",
      "value": "El módulo fileadmin.php en Libra File Manager (también conocido como Libra PHP File Manager) v1.18 y anteriores permite a atacantes remotos evitar la autenticación, leer ficheros arbitrarios, modificar ficheros arbitrarios y listar el contenido de directorios arbitrarios, al insertar ciertos parámetros \"user\" e \"isadmin\" en la cadena de consulta."
    }
  ],
  "lastModified": "2026-06-16T22:57:35.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93AF7428-B3B2-4962-A3EC-7417FCF22B60",
              "versionEndIncluding": "1.18"
            },
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C83A5C9-A836-4B7F-A0E0-4C354525A08A"
            },
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB9543DA-0F76-4438-BE61-51D42412A813"
            },
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A152A89-1E0A-47A3-AABD-C5FBC4869EDD"
            },
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.08:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D225985-9697-4704-AA54-1A9B9D7B8988"
            },
            {
              "criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DFE7EF9-9374-4DF3-9851-E830D424A7AF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}