CVE-2014-8606

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. (dot dot) in the file parameter within a json return action in the xcloner show page to the "wp-admin/admin-ajax.php" endpoint.

Recommendations For XCloner plugin version 3.1.1 for WordPress, update to a version that addresses this issue. For XCloner plugin version 3.5.1 for Joomla!, update to a version that addresses this issue. As a temporary workaround, consider restricting access to the xcloner show page and the wp-admin/admin-ajax.php endpoint to minimize the risk of exploitation.