CVE-2023-4019

2023-09-0412:15:10

[email protected]

web.nvd.nist.gov

cve-2023-4019

nvd

ftp wordpress plugin

unauthorized access

rce

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.

Affected configurations

Vulners

NVD

Node

media_from_ftp_projectmedia_from_ftpRange<11.17

VendorProductVersionCPE
media_from_ftp_projectmedia_from_ftp*cpe:2.3:a:media_from_ftp_project:media_from_ftp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
media_from_ftp_project	media_from_ftp	*	cpe:2.3:a:media_from_ftp_project:media_from_ftp::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Media from FTP",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "11.17"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]