PT-2017-14578 · WordPress · Duplicator

Publicado 2017-11-14 · Atualizado 2017-11-30 · CVE-2017-16815

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Duplicator (WordPress Site Migration & Backup) plugin versions prior to 1.2.30

Description The issue arises from insufficient filtering of the url new and logging values in the installer.php file. This can lead to XSS attacks. The url new value is related to the '/wp-content/plugins/duplicator/installer/build/view.step4.php' endpoint, and the logging value is related to the 'wp-content/plugins/duplicator/installer/build/view.step2.php' endpoint.

Recommendations For Duplicator (WordPress Site Migration & Backup) plugin versions prior to 1.2.30, update to version 1.2.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the installer.php file until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16815

Produtos afetados

Duplicator

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-16815 · Aviso do Fabricante
• https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16815 · Nota de Segurança
• https://snapcreek.com/duplicator/docs/changelog · Aviso do Fabricante