CVE-2024-2324 FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scripting
Authenticated attackers can inject arbitrary scripts via SVG uploads in FileOrganizer, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2324?
CVE-2024-2324 is a medium-severity cross-site scripting vulnerability in softaculous FileOrganizer – WordPress File Manager, published on 2 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. For the free version, this is limited to administrators. The pro version is also vulnerable and exploitable by administrators, but also offers the functionality to lower level users (as low as subscribers) if enabled.
Weakness: CWE-79
Which versions are affected by CVE-2024-2324?
It affects 1 product.
Products include Fileorganizer Fileorganizer.
How do I fix CVE-2024-2324?
No fix has been published for CVE-2024-2324 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-2324 being exploited?
There is no known exploitation of CVE-2024-2324 in the wild and no public exploit code.
Other vulnerabilities in softaculous FileOrganizer – WordPress File Manager
Sources
Also known as GHSA-xprr-mw6x-6m8m.