PT-2024-12606 · Stylemixthemes · Stylemixthemes Consulting

Dave Jong · Published 2024-05-17 · Updated 2024-07-09 · CVE-2023-37385

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions StylemixThemes Consulting versions through 6.5.6

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This allows PHP Local File Inclusion, which can be exploited by attackers to access sensitive files.

Recommendations For versions through 6.5.6, patch immediately to mitigate the risk of path traversal and PHP Local File Inclusion.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-37385

Affected Products

Stylemixthemes Consulting

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-37385 · Security Note
• https://twitter.com/oktsec/status/1810889084862071049 · Twitter Post
• https://twitter.com/CVEnew/status/1791391000189083842 · Twitter Post
• https://patchstack.com/database/vulnerability/consulting/wordpress-consulting-theme-6-3-6-local-file-inclusion?_s_id=cve · Note