CVE-2019-14788

🗓️ 15 Aug 2019 15:45:22Reported by mitreType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Vulnerability in Tribulant Newsletters plugin allows directory traversal and remote code execution.

Reporter	Title	Published	Views	Family All 10
CNVD	WordPress Tribulant Newsletters Plugin Path Traversal Vulnerability	16 Aug 201900:00	–	cnvd
Cvelist	CVE-2019-14788	15 Aug 201915:45	–	cvelist
EUVD	EUVD-2019-5920	7 Oct 202500:30	–	euvd
NVD	CVE-2019-14788	15 Aug 201916:15	–	nvd
OSV	CVE-2019-14788	15 Aug 201916:15	–	osv
Prion	Directory traversal	15 Aug 201916:15	–	prion
Positive Technologies	PT-2019-13833 · Tribulant · Tribulant Newsletters	15 Aug 201900:00	–	ptsecurity
RedhatCVE	CVE-2019-14788	22 May 202507:47	–	redhatcve
wpexploit	Newsletter Lite < 4.6.19 - Multiple Issues	1 Jul 201900:00	–	wpexploit
WPVulnDB	Newsletter Lite < 4.6.19 - Multiple Issues	1 Jul 201900:00	–	wpvulndb

NVD

Node

tribulant newslettersRange<4.6.19wordpress

Source	Link
pluginvulnerabilities	www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters/
wpvulndb	www.wpvulndb.com/vulnerabilities/9447
wordpress	www.wordpress.org/plugins/newsletters-lite/

Parameter	Position	Path	Description	CWE
exportfile	query param	wp-admin/admin-ajax.php?action=newsletters_exportmultiple	Directory traversal with potential remote code execution via exportfile parameter in newsletters_exportmultiple	CWE-22
subscribers[1][1]	query param	wp-admin/admin-ajax.php?action=newsletters_exportmultiple	Directory traversal with potential remote code execution via exportfile parameter in newsletters_exportmultiple	CWE-22
contentarea	query param	wp-admin/admin-ajax.php?action=newsletters_load_new_editor	Authenticated reflected XSS via unsanitized contentarea parameter in newsletters_load_new_editor	CWE-22

21 Nov 2024 04:27Current

9High risk

Vulners AI Score9

CVSS 26.5

CVSS 3.18.8

EPSS0.01546