PT-2024-3160 · Unknown · Backupwordpress

Dk0Pf + 1 · Published 2024-03-27 · Updated 2024-04-29 · CVE-2024-3034

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: BackUpWordPress versions up to, and including, 3.13

Description: The issue is related to errors in handling relative path to directory when processing the hmbkp directory browse parameter, allowing remote attackers to gain unauthorized access to protected information. This vulnerability enables authenticated attackers with administrator-level access and above to traverse directories outside of the allowed context via the hmbkp directory browse parameter.

Recommendations: For versions up to, and including, 3.13, consider disabling the hmbkp directory browse parameter until a patch is available to prevent directory traversal attacks. Restrict access to sensitive directories and ensure that only necessary personnel have administrator-level access to minimize the risk of exploitation.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

BDU:2024-03373

CVE-2024-3034

Affected Products

Backupwordpress

References · 9

• https://bdu.fstec.ru/vul/2024-03373 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3034 · Security Note
• https://github.com/xibodevelopment/backupwordpress · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076291%40backupwordpress&new=3076291%40backupwordpress&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076291%40backupwordpress&new=3076291%40backupwordpress&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/backupwordpress/backupwordpress-313-authenticated-admin-directory-traversal · Note
• https://t.me/cvenotify/78238 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c2805cb0-8913-4487-8445-031b7d920e2d?source=cve · Note
• https://vuldb.com/?id.262185 · Note