PT-2024-25546 · Unknown · Xserver Migrator

Dimas Maulana · Published 2024-05-02 · Updated 2024-05-02 · CVE-2024-33913

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xserver Migrator versions 1.6.1 and earlier

Description A Cross-Site Request Forgery (CSRF) issue leads to Arbitrary File Upload in Xserver Migrator. This allows an attacker to potentially upload arbitrary files.

Recommendations For versions 1.6.1 and earlier, update to a version later than 1.6.1 to resolve the issue. As a temporary workaround, consider implementing CSRF protection measures to prevent unauthorized requests. Restrict access to file upload functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-33913

Affected Products

Xserver Migrator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-33913 · Security Note
• https://t.me/cvenotify/78812 · Telegram Post
• https://patchstack.com/database/vulnerability/xserver-migrator/wordpress-xserver-migrator-plugin-1-6-1-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1786000842665123886 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1786012380456972722 · Twitter Post
• https://twitter.com/linuxpatch/status/1786004493080895628 · Twitter Post