CVE-2024-24573

Name of the Vulnerable Software and Affected Versions facileManager versions 4.5.0 and earlier

Description The issue allows non-admin users to arbitrarily set their permissions and grant their non-admin accounts with super user privileges when updating their profile. This is done through a POST request containing user information sent to the endpoint "server/fm-modules/facileManager/ajax/processPost.php".

Recommendations For versions 4.5.0 and earlier, as a temporary workaround, consider restricting access to the "server/fm-modules/facileManager/ajax/processPost.php" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.