PT-2023-10158 · Unknown · Media Downloader Plugin

Published 2023-03-04 · Updated 2024-05-17 · CVE-2014-125090

Positive Technologies · (AI Summary)

CVSS v2.0

4.0

Medium

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Media Downloader Plugin version 0.1.992

Description A vulnerability was found in the Media Downloader Plugin, affecting the dl file resumable function of the getfile.php file. The manipulation of the file argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For Media Downloader Plugin version 0.1.992, upgrade to version 0.1.993 to address this issue. As a temporary workaround, consider disabling the dl file resumable function until the patch is applied. Restrict access to the getfile.php file to minimize the risk of exploitation. Avoid using the file argument in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-125090

Affected Products

Media Downloader Plugin

References · 6

• https://github.com/wp-plugins/media-downloader/commit/77beb720c682b9300035ab5f96eee225181d8a92 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-125090 · Security Note
• https://t.me/cvenotify/45529 · Telegram Post
• https://vuldb.com/?ctiid.222262 · Note
• https://t.me/cvenotify/60663 · Telegram Post
• https://vuldb.com/?id.222262 · Note