PT-2015-4051 · Open Source Matters+1 · Joomla!+1

Larry W. Cashdollar + 1 · Publicado 2015-06-10 · Atualizado 2015-06-11 · CVE-2014-8605

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description The issue allows remote attackers to obtain sensitive information by directly requesting a backup file due to predictable file names and insufficient access control. The backup files are stored under the web root in administrators/backups/.

Recommendations For XCloner plugin version 3.1.1 for WordPress, restrict access to the administrators/backups/ directory to prevent unauthorized access to backup files. For XCloner plugin version 3.5.1 for Joomla!, restrict access to the administrators/backups/ directory to prevent unauthorized access to backup files.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-8605

Produtos afetados

Joomla!

Xcloner

Referências · 5

• 🔥 http://vapid.dhs.org/advisory.php?v=110 · Exploit
• 🔥 https://exploit-db.com/exploits/35212 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8605 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8605 · Nota