{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.64"}],"component":"studio-42/elfinder","cve_ids":["CVE-2024-38909"],"ecosystem":"Packagist","epss":0.0048,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3h9f-mm2x-4j58","id":"tcs_01M5KET0PFA6G9MJVGCJRZ29XX","modified_at":"2024-10-25T22:10:55.531754Z","published_at":"2024-07-30T15:31:28Z","references":["https://osv.dev/vulnerability/GHSA-3h9f-mm2x-4j58","https://nvd.nist.gov/vuln/detail/CVE-2024-38909","https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909","https://github.com/Studio-42/elFinder","http://elfinder.com"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-3h9f-mm2x-4j58","url":"https://osv.dev/vulnerability/GHSA-3h9f-mm2x-4j58"}],"summary":"Studio 42 elFinder vulnerable to Incorrect Access Control"}