PT-2017-14578 · WordPress · Duplicator

Published 2017-11-14 · Updated 2017-11-30 · CVE-2017-16815

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Duplicator (WordPress Site Migration & Backup) plugin versions prior to 1.2.30

Description The issue arises from insufficient filtering of the url new and logging values in the installer.php file. This can lead to XSS attacks. The url new value is related to the '/wp-content/plugins/duplicator/installer/build/view.step4.php' endpoint, and the logging value is related to the 'wp-content/plugins/duplicator/installer/build/view.step2.php' endpoint.

Recommendations For Duplicator (WordPress Site Migration & Backup) plugin versions prior to 1.2.30, update to version 1.2.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the installer.php file until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16815

Affected Products

Duplicator

References · 4

• https://osv.dev/vulnerability/CVE-2017-16815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16815 · Security Note
• https://snapcreek.com/duplicator/docs/changelog · Vendor Advisory
• https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.html · Note