PT-2021-22081 · Unknown · Wp-Publications

P7E4 · Published 2021-09-10 · Updated 2021-09-21 · CVE-2021-38360

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions wp-publications versions up to and including 0.0

Description The issue allows for restrictive local file inclusion via the Q FILE parameter in the ~/bibtexbrowser.php file, enabling attackers to include local zip files and achieve remote code execution.

Recommendations For versions up to and including 0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-829

CWE-22

Related Identifiers

CVE-2021-38360

Affected Products

Wp-Publications

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-38360 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2021-38360 · Note
• https://plugins.trac.wordpress.org/browser/wp-publications/trunk/bibtexbrowser.php?rev=1830330#L49 · Note