Affected versions: ≥ 3.7 and < 3.8
Full advisory: www.valorapps.com
CVE-2024-11145CriticalCVSS 9.3CVE published 26 November 2024Added to mySites.guru 26 November 2024
Easy Folder Listing Pro (com_easyfolderlistingpro) 3.7 - Unauthenticated Deserialization Remote Code Execution
Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 3.x branch: update to 3.8 or later. The 4.x branch is affected separately at 4.4 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.
Is my site affected?
CVE-2024-11145 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Easy Folder Listing Pro | from 3.7 up to but not including 3.8 | 3.8 | Update Easy Folder Listing Pro to 3.8 or later. |
| Easy Folder Listing Pro | from 4.4 up to but not including 4.5 | 4.5 | Update Easy Folder Listing Pro to 4.5 or later. |
How CVE-2024-11145 is scored
The base metrics as CISA CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.3 Critical
CVSS 4.0, scored by CISA CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Timeline
- 26 November 2024CVE-2024-11145 record published by its CNA
- 26 November 2024mySites.guru check added for Easy Folder Listing Pro (from 3.7 up to but not including 3.8)
- 26 November 2024mySites.guru check added for Easy Folder Listing Pro (from 4.4 up to but not including 4.5)
Rule details
Easy Folder Listing Pro - Easy Folder Listing Pro (com_easyfolderlistingpro) 4.4 - Unauthenticated Deserialization Remote Code Execution
Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 4.x branch: update to 4.5 or later. The 3.x branch is affected separately at 3.7 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.
Affected versions: ≥ 4.4 and < 4.5
Full advisory: www.valorapps.com
Other vulnerabilities in Easy Folder Listing Pro
Updating for CVE-2024-11145 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Easy Folder Listing Pro
Latest safe version: 4.5
References
- CVE-2024-11145 on cve.org (the official CVE record)
- CVE-2024-11145 in the NIST National Vulnerability Database
- valorapps.com/web-products/easy-folder-listing-pro.html
CVE-2024-11145 questions
Which versions are affected by CVE-2024-11145?
CVE-2024-11145 is covered by 2 rules: Easy Folder Listing Pro from 3.7 up to but not including 3.8; Easy Folder Listing Pro from 4.4 up to but not including 4.5.
How do I fix CVE-2024-11145?
It depends on the extension and release line your site runs. For Easy Folder Listing Pro from 3.7 up to but not including 3.8: update Easy Folder Listing Pro to 3.8 or later. For Easy Folder Listing Pro from 4.4 up to but not including 4.5: update Easy Folder Listing Pro to 4.5 or later.
How severe is CVE-2024-11145?
CISA CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.