CVE-2022-40916

CVE-2022-40916 is a session fixation vulnerability affecting Tiny File Manager versions 2.4.7 and below. This issue, linked to CWE-384, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact across confidentiality, integrity, and availability.

The vulnerability enables remote attackers to exploit it over the network with low attack complexity, requiring no authentication privileges or user interaction. By fixing a session identifier, an attacker can hijack authenticated sessions, achieving high-impact unauthorized access, data manipulation, and disruption of the file manager's operations.

Mitigation details and patches are available in the Tiny File Manager GitHub repository at https://github.com/prasathmani/tinyfilemanager. A proof-of-concept demonstrating the exploit is provided at https://github.com/whitej3rry/CVE-2022-40916/blob/main/PoC.md.