PT-2019-13529 · Nevma · Nevma Adaptive Images

Mark Gruffer · Published 2019-07-21 · Updated 2022-04-18 · CVE-2019-14205

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nevma Adaptive Images plugin versions prior to 0.6.67

Description A Local File Inclusion issue allows remote attackers to retrieve arbitrary files. This is achieved via the adaptive-images-settings parameter, specifically through the source file variable in the adaptive-images-script.php file.

Recommendations For versions prior to 0.6.67, update to version 0.6.67 or later to resolve the issue. As a temporary workaround, consider restricting access to the adaptive-images-script.php file to minimize the risk of exploitation. Avoid using the source file variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-14205

Affected Products

Nevma Adaptive Images

References · 6

• 🔥 https://wpvulndb.com/vulnerabilities/9468 · Exploit
• 🔥 https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown · Exploit
• 🔥 https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14205 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14205 · Vendor Advisory
• https://wordpress.org/plugins/adaptive-images/#developers · Note