PT-2014-6434 · WordPress · Wp Content Source Control

Publicado 2014-08-22 · Atualizado 2017-09-08 · CVE-2014-5368

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Content Source Control plugin versions 3.0.0 and earlier

Description A directory traversal issue exists in the file get contents function within the downloadfiles/download.php file of the WP Content Source Control plugin. This allows remote attackers to read arbitrary files by including a .. (dot dot) in the path parameter.

Recommendations For WP Content Source Control plugin versions 3.0.0 and earlier, consider disabling the downloadfiles/download.php file until a patch is available to prevent exploitation of the directory traversal issue. Restrict access to the file get contents function to minimize the risk of reading arbitrary files. Avoid using the path parameter in the affected download.php file until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-5368

Produtos afetados

Wp Content Source Control

Referências · 7

• 🔥 http://seclists.org/oss-sec/2014/q3/417 · Exploit
• 🔥 https://exploit-db.com/exploits/39287 · Exploit
• 🔥 http://securityfocus.com/bid/69278 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q3/407 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5368 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5368 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95374 · Nota