PT-2023-28563 · WordPress · Wpvivid

Ivan Kuzymchak · Publicado 2023-10-19 · Atualizado 2023-10-27 · CVE-2023-4274

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Migration, Backup, Staging – WPvivid plugin for WordPress versions up to, and including, 0.9.89

Description The issue allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server. This can be a critical issue in shared environments.

Recommendations For versions up to, and including, 0.9.89, update to a version higher than 0.9.89 to resolve the issue. As a temporary workaround, consider restricting administrative access to trusted users only until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-4274

Produtos afetados

Wpvivid

Referências · 6

• 🔥 https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200 · Exploit
• https://twitter.com/CVEnew/status/1715259855747928442 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail= · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-4274 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-4274 · Aviso do Fabricante