PT-2013-3908 · Ithemes · Backupbuddy

Publicado 2013-04-02 · Atualizado 2013-04-02 · CVE-2013-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BackupBuddy plugin versions 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4

Description The issue arises from the importbuddy.php script in the BackupBuddy plugin, which does not reliably delete itself after completing a restore operation. This oversight makes it easier for remote attackers to obtain access via subsequent requests to this script.

Recommendations For BackupBuddy plugin version 1.3.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.1.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.25, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.28, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access.

Exploit

Correção

Identificadores relacionados

CVE-2013-2742

Produtos afetados

Backupbuddy

Referências · 4

• 🔥 http://packetstormsecurity.com/files/120923 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2742 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2742 · Nota de Segurança