PT-2024-33470 · Vivek Tamrakar · Wp Rest Api Fns

Stealthcopter · Published 2024-10-20 · Updated 2024-10-24 · CVE-2024-49329

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vivek Tamrakar WP REST API FNS versions 1.0.0 and earlier

Description The issue allows attackers to upload harmful content, including web shells, to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This can be exploited by uploading a web shell, which could lead to further malicious activities.

Recommendations For versions 1.0.0 and earlier, update to version 1.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the upload functionality until the update is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-49329

Affected Products

Wp Rest Api Fns

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-49329 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49329 · Vendor Advisory
• https://patchstack.com/database/Wordpress/Plugin/rest-api-fns/vulnerability/wordpress-wp-rest-api-fns-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/98886 · Telegram Post
• https://t.me/cvenotify/99374 · Telegram Post
• https://t.me/cvedetector/8411 · Telegram Post
• https://t.me/latest_high_impact_cve/1365 · Telegram Post
• https://twitter.com/vuldb/status/1847933159067058417 · Twitter Post
• https://twitter.com/CveFindCom/status/1847926186749411616 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1847963890707046725 · Twitter Post
• https://twitter.com/CVEnew/status/1847923905505243435 · Twitter Post
• https://patchstack.com/database/vulnerability/rest-api-fns/wordpress-wp-rest-api-fns-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve · Note