Lucene search

PatchstackCVE-2024-25909

HistoryFeb 26, 2024 - 4:27 p.m.

CVE-2024-25909

2024-02-2616:27:59

CWE-434

Patchstack

web.nvd.nist.gov

cve-2024-25909

unrestricted upload

file upload vulnerability

joomunited

wp media folder

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.

Affected configurations

Vulners

Vulnrichment

Node

joomunitedwp_meta_seoRange≤5.7.2wordpress

VendorProductVersionCPE
joomunitedwp_meta_seo*cpe:2.3:a:joomunited:wp_meta_seo:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
joomunited	wp_meta_seo	*	cpe:2.3:a:joomunited:wp_meta_seo::::::wordpress::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WP Media folder",
    "vendor": "JoomUnited",
    "versions": [
      {
        "changes": [
          {
            "at": "5.7.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.7.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-subscriber-arbitrary-file-upload-vulnerability?_s_id=cve

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-25909