PT-2019-13833 · Tribulant · Tribulant Newsletters

Published 2019-08-15 · Updated 2023-05-18 · CVE-2019-14788

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tribulant Newsletters plugin versions prior to 4.6.19

Description The issue allows directory traversal with resultant remote PHP code execution. This is achieved via the subscribers[1][1] parameter in conjunction with an exportfile=../ value in the "/wp-admin/admin-ajax.php?action=newsletters exportmultiple" API endpoint.

Recommendations For versions prior to 4.6.19, update to version 4.6.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-admin/admin-ajax.php?action=newsletters exportmultiple" API endpoint to minimize the risk of exploitation. Avoid using the subscribers[1][1] parameter and the exportfile parameter with a value of "../" in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-14788

Affected Products

Tribulant Newsletters

References · 6

• 🔥 https://pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters · Exploit
• https://osv.dev/vulnerability/CVE-2019-14788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14788 · Security Note
• https://wordpress.org/plugins/newsletters-lite/#developers · Note
• https://t.me/cvenotify/50732 · Telegram Post
• https://wpvulndb.com/vulnerabilities/9447 · Note