PT-2015-4052
CVE-2014-8606
·
تاريخ النشر
2015-06-10
·
تاريخ التحديث
2015-06-11
الوصف من
CVSS 2.0
4.0
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
XCloner plugin version 3.1.1 for WordPress
XCloner plugin version 3.5.1 for Joomla!
Description
A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. (dot dot) in the
file parameter within a json return action in the xcloner show page to the "wp-admin/admin-ajax.php" endpoint.Recommendations
For XCloner plugin version 3.1.1 for WordPress, update to a version that addresses this issue.
For XCloner plugin version 3.5.1 for Joomla!, update to a version that addresses this issue.
As a temporary workaround, consider restricting access to the
xcloner show page and the wp-admin/admin-ajax.php endpoint to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾