PT-2021-11015 · WordPress · Media File Organizer

Published 2021-07-07 · Updated 2021-07-10 · CVE-2020-24144

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Media File Organizer plugin version 1.0.1 for WordPress

Description: The issue allows an attacker to access files stored outside the web root folder via the items[] parameter in a move operation. This is a result of a directory traversal vulnerability in the Media File Organizer plugin for WordPress.

Recommendations: For Media File Organizer plugin version 1.0.1, consider disabling the move operation feature until a patch is available to prevent exploitation of the directory traversal vulnerability. Restrict access to sensitive files and folders to minimize the risk of unauthorized access.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-24144

Affected Products

Media File Organizer

References · 5

• 🔥 https://github.com/secwx/research/blob/main/cve/CVE-2020-24144.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24144 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24144 · Vendor Advisory
• https://ru.wordpress.org/plugins/media-file-organizer · Vendor Advisory
• https://t.me/cvenotify/17408 · Telegram Post