PT-2014-6434 · WordPress · Wp Content Source Control

Published 2014-08-22 · Updated 2017-09-08 · CVE-2014-5368

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Content Source Control plugin versions 3.0.0 and earlier

Description A directory traversal issue exists in the file get contents function within the downloadfiles/download.php file of the WP Content Source Control plugin. This allows remote attackers to read arbitrary files by including a .. (dot dot) in the path parameter.

Recommendations For WP Content Source Control plugin versions 3.0.0 and earlier, consider disabling the downloadfiles/download.php file until a patch is available to prevent exploitation of the directory traversal issue. Restrict access to the file get contents function to minimize the risk of reading arbitrary files. Avoid using the path parameter in the affected download.php file until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-5368

Affected Products

Wp Content Source Control

References · 7

• 🔥 http://seclists.org/oss-sec/2014/q3/417 · Exploit
• 🔥 https://exploit-db.com/exploits/39287 · Exploit
• 🔥 http://securityfocus.com/bid/69278 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q3/407 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5368 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5368 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95374 · Note