Lucene search

[email protected]NVD:CVE-2024-0697

HistoryJan 27, 2024 - 5:15 a.m.

CVE-2024-0697

2024-01-2705:15:08

CWE-22

[email protected]

web.nvd.nist.gov

backuply plugin

wordpress

directory traversal

node_id parameter

attackers

sensitive files

cve-2024-0697

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator privileges or higher to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected configurations

Nvd

Node

softaculousbackuplyRange≤1.2.3wordpress

VendorProductVersionCPE
softaculousbackuply*cpe:2.3:a:softaculous:backuply:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
softaculous	backuply	*	cpe:2.3:a:softaculous:backuply::::::wordpress::*

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026806%40backuply&new=3026806%40backuply&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/70effa22-fbf6-44cb-9d1b-8625969c10ac?source=cve

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

Related for NVD:CVE-2024-0697

cvelist1 openvas1 wpvulndb1 prion1 cve1 wordfence1