Lucene search

CVE-2023-0156

🗓️ 10 Apr 2023 14:08:15Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 59 Views🌐 WEB

The AIOS WordPress plugin before 5.1.5 allows admin+ users to view arbitrary file contents and list directories

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 6
NVD	CVE-2023-0156	10 Apr 202314:15	–	nvd
Prion	Code injection	10 Apr 202314:15	–	prion
Vulnrichment	CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal	10 Apr 202313:17	–	vulnrichment
WPVulnDB	All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal	20 Mar 202300:00	–	wpvulndb
Cvelist	CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal	10 Apr 202313:17	–	cvelist
wpexploit	All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal	20 Mar 202300:00	–	wpexploit

Nvd

Vulners

Node

updraftplus all-in-one_securityRange<5.1.5wordpress

[
  {
    "vendor": "Unknown",
    "product": "All-In-One Security (AIOS)",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "5.1.5"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759

Parameter	Position	Path	Description	CWE
aiowps_system_log_file	request body	/wp-admin/admin.php?page=aiowpsec_filesystem&tab=tab4	The plugin does not limit log files that can be displayed, allowing potential access to sensitive files like /etc/passwd.	CWE-22
aiowps_search_error_files	request body	/wp-admin/admin.php?page=aiowpsec_filesystem&tab=tab4	The plugin does not limit log files that can be displayed, allowing potential access to sensitive files like /etc/passwd.	CWE-22

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

10 Apr 2023 14:15Current

5Medium risk

Vulners AI Score5

CVSS34.9

EPSS0.51943

SSVC

CWE-22