CVE-2012-3577

2012-06-1703:41:42

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-3577

file upload

vulnerability

nmedia member conversation

wordpress

remote code execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8 High

AI Score

Confidence

Low

0.248 Low

EPSS

Percentile

96.7%

JSON

Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.

Affected configurations

NVD

Node

nmediamember_conversationRange≤1.3

nmediamember_conversationMatch1.0

nmediamember_conversationMatch1.2

AND

wordpresswordpressMatch-

CPENameOperatorVersion
nmedia:member_conversationnmedia member conversationle1.3
nmedia:member_conversationnmedia member conversationeq1.0
nmedia:member_conversationnmedia member conversationeq1.2

CPE	Name	Operator	Version
nmedia:member_conversation	nmedia member conversation	le	1.3
nmedia:member_conversation	nmedia member conversation	eq	1.0
nmedia:member_conversation	nmedia member conversation	eq	1.2