Lucene search

K
cve[email protected]CVE-2024-4347
HistoryMay 23, 2024 - 6:15 a.m.

CVE-2024-4347

2024-05-2306:15:11
web.nvd.nist.gov
46
wp fastest cache
wordpress
directory traversal
authenticated attackers
arbitrary files
shared hosting

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.3%

The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function. This makes it possible for authenticated attackers to delete arbitrary files on the server, which can include wp-config.php files of the affected site or other sites in a shared hosting environment.

Affected configurations

Vulners
Node
emrevonawp_fastest_cacheRange1.2.6

CNA Affected

[
  {
    "vendor": "emrevona",
    "product": "WP Fastest Cache",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.2.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.3%

Related for CVE-2024-4347