Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cvelistVulDBCVELIST:CVE-2014-125104
HistoryJun 01, 2023 - 1:00 p.m.

CVE-2014-125104 VaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted upload

2023-06-0113:00:04
CWE-434
VulDB
www.cve.org
3
wordpress
mailpoet plugin
vulnerability
unrestricted upload
upgrade
remote attack
critical issue
patch
vdb-230263

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "VaultPress Plugin",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      },
      {
        "version": "1.1",
        "status": "affected"
      },
      {
        "version": "1.2",
        "status": "affected"
      },
      {
        "version": "1.3",
        "status": "affected"
      },
      {
        "version": "1.4",
        "status": "affected"
      },
      {
        "version": "1.5",
        "status": "affected"
      },
      {
        "version": "1.6",
        "status": "affected"
      }
    ],
    "modules": [
      "MailPoet Plugin"
    ]
  }
]

Related

cve 1
prion 1
nvd 1
cve
cve
CVE-2014-125104
2023-06-01 13:15:10
prion
prion
Out-of-bounds
2023-06-01 13:15:00
nvd
nvd
CVE-2014-125104
2023-06-01 13:15:10

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON
Related for CVELIST:CVE-2014-125104
cve1prion1nvd1