PT-2013-3907 · Ithemes · Backupbuddy

Publicado 2013-04-02 · Atualizado 2013-04-02 · CVE-2013-2741

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BackupBuddy plugin versions 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4

Description The issue allows remote attackers to obtain sensitive information, or overwrite or delete files, via various vectors involving direct or step-specific requests to importbuddy.php. This is possible because the importbuddy.php file in the affected plugin does not require authentication to be enabled.

Recommendations For BackupBuddy plugin version 1.3.4, update to a version that requires authentication for importbuddy.php. For BackupBuddy plugin version 2.1.4, update to a version that requires authentication for importbuddy.php. For BackupBuddy plugin version 2.2.25, update to a version that requires authentication for importbuddy.php. For BackupBuddy plugin version 2.2.28, update to a version that requires authentication for importbuddy.php. For BackupBuddy plugin version 2.2.4, update to a version that requires authentication for importbuddy.php.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-2741

Produtos afetados

Backupbuddy

Referências · 4

• 🔥 http://packetstormsecurity.com/files/120923 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2741 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2741 · Nota de Segurança