Lucene search

Japan Vulnerability NotesJVN:63249051

HistoryJul 06, 2017 - 12:00 a.m.

JVN#63249051: WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal

2017-07-0600:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

40.8%

JSON

The WordPress plugin “Shortcodes Ultimate” contains a directory traversal vulnerability (CWE-22) in the Examples page.

Impact

Arbitrary local files on the server may be accessed by a logged-in user.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

Shortcodes Ultimate prior to version 4.10.0

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

40.8%

JSON

Related for JVN:63249051