PT-2019-10434 · WordPress · Woo-Confirmation-Email

Publicado 2019-08-29 · Atualizado 2019-09-07 · CVE-2018-21007

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions woo-confirmation-email plugin versions prior to 3.2.0

Description The issue concerns the woo-confirmation-email plugin for WordPress, where there is no blocking of direct access to supportive xl folders inside uploads.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2018-21007

Produtos afetados

Woo-Confirmation-Email

Referências · 4

• https://wordpress.org/plugins/woo-confirmation-email/#developers · Nota
• https://wpvulndb.com/vulnerabilities/9847 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-21007 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-21007 · Aviso do Fabricante