PT-2023-10158 · Unknown · Media Downloader Plugin

CVE-2014-125090 · Publicado 2023-03-04 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Media Downloader Plugin version 0.1.992

Description A vulnerability was found in the Media Downloader Plugin, affecting the dl file resumable function of the getfile.php file. The manipulation of the file argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For Media Downloader Plugin version 0.1.992, upgrade to version 0.1.993 to address this issue. As a temporary workaround, consider disabling the dl file resumable function until the patch is applied. Restrict access to the getfile.php file to minimize the risk of exploitation. Avoid using the file argument in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-125090

Produtos afetados

Media Downloader Plugin

Referências · 6

• https://github.com/wp-plugins/media-downloader/commit/77beb720c682b9300035ab5f96eee225181d8a92 · Correção
• https://t.me/cvenotify/45529 · Publicação no Telegram
• https://vuldb.com/?ctiid.222262 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-125090 · Nota de Segurança
• https://t.me/cvenotify/60663 · Publicação no Telegram
• https://vuldb.com/?id.222262 · Nota