PT-2024-32953 · WordPress · Acf Images Search/Insert

Stealthcopter · Published 2024-10-16 · Updated 2024-10-16 · CVE-2024-48035

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACF Images Search And Insert versions 1.1.4 and earlier

Description The issue affects the ACF Images Search And Insert plugin, allowing unrestricted upload of files with dangerous types, such as a web shell, to a web server. This could potentially compromise web servers.

Recommendations For versions 1.1.4 and earlier, upgrade to version 1.1.5 to resolve the issue. As a temporary workaround, consider restricting the upload functionality to prevent uploading files with dangerous types until the patch is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-48035

Affected Products

Acf Images Search/Insert

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-48035 · Security Note
• https://patchstack.com/database/vulnerability/acf-images-search-and-insert/wordpress-acf-images-search-and-insert-plugin-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/8077 · Telegram Post
• https://twitter.com/CVEnew/status/1846545348270997585 · Twitter Post
• https://t.me/latest_high_impact_cve/1341 · Telegram Post
• https://twitter.com/CveFindCom/status/1846545364041539606 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846662561095160247 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/acf-images-search-and-insert/vulnerability/wordpress-acf-images-search-and-insert-plugin-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve · Note