PT-2019-13529 · Nevma · Nevma Adaptive Images

Mark Gruffer · Publicado 2019-07-21 · Atualizado 2022-04-18 · CVE-2019-14205

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nevma Adaptive Images plugin versions prior to 0.6.67

Description A Local File Inclusion issue allows remote attackers to retrieve arbitrary files. This is achieved via the adaptive-images-settings parameter, specifically through the source file variable in the adaptive-images-script.php file.

Recommendations For versions prior to 0.6.67, update to version 0.6.67 or later to resolve the issue. As a temporary workaround, consider restricting access to the adaptive-images-script.php file to minimize the risk of exploitation. Avoid using the source file variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-14205

Produtos afetados

Nevma Adaptive Images

Referências · 6

• 🔥 https://wpvulndb.com/vulnerabilities/9468 · Exploit
• 🔥 https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown · Exploit
• 🔥 https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14205 · Nota de Segurança
• https://wordpress.org/plugins/adaptive-images/#developers · Nota
• https://osv.dev/vulnerability/CVE-2019-14205 · Aviso do Fabricante