PT-2018-17946 · Giribaz · Giribaz File Manager

Published 2018-03-07 · Updated 2019-10-03 · CVE-2018-7204

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Giribaz File Manager plugin versions prior to 5.0.2

Description The issue allows sensitive information to be logged in an unprotected file. When a user edits the wp-config.php file using the plugin, its contents, including database credentials and salts, are added to the log file /wp-content/uploads/file-manager/log.txt. This log file is not protected and has been indexed by Google, making it possible to find affected sites using a simple search query.

Recommendations For Giribaz File Manager plugin versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /wp-content/uploads/file-manager/log.txt file to minimize the risk of exploitation. Additionally, restrict access to the wp-config.php file when using the plugin to edit it, and avoid using the plugin for this purpose until the issue is resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-7204

Affected Products

Giribaz File Manager

References · 5

• https://plugins.trac.wordpress.org/changeset/1823035/file-manager · Patch
• https://osv.dev/vulnerability/CVE-2018-7204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7204 · Security Note
• https://wpvulndb.com/vulnerabilities/9036 · Note
• https://wordpress.org/plugins/file-manager/#developers · Note